A shopper buys running shoes in Gemini

The situation

A shopper asks Gemini for a pair of trail running shoes in size 10 under a set price, picks one, and pays with the card saved in Google Pay. The shopper is present for the whole purchase. The merchant, not Google, is the merchant of record and keeps the financial liability and the order.^{Source [1, 2]}

Two layers are involved, and they are not equally live. UCP-powered checkout began rolling out to US shoppers in AI Mode in Search and the Gemini app on 2026-02-11, starting with Etsy and Wayfair items.^{Source [3]} The AP2 mandate layer is specified inside UCP as an optional extension.^{Source [2, 4]} Google said on 2026-05-19 that it would begin bringing AP2 to its products in the coming months, starting with Gemini Spark.^{Source [5]} Production use of AP2 mandates is unverified anywhere, including inside UCP, as of 2026-10-11.^{Source [6, 7]? unverified} Read the AP2 steps below as “per spec; live use unverified”.

Actors

• Shopper, present and approving.
• Gemini, the UCP platform and, in AP2 terms, the Shopping Agent.
• Trusted checkout UI, the AP2 Trusted Surface, which must be non-agentic.^{Source [8]}
• Google Pay, the credential provider, whose handler com.google.pay is a specification authored by the provider.^{Source [9]}
• Merchant, the UCP business, which publishes its profile at /.well-known/ucp.^{Source [9]}
• Merchant PSP, the AP2 Merchant Payment Processor, plus the card network and issuer.^{Source [8]}

Step by step

1. Ask (no protocol). The shopper describes what they want.
2. Discover (UCP). Gemini reads the merchant profile; it requires a ucp object with version, services and payment_handlers, and signing keys sit in a top-level keys array.^{Source [9, 10]} A merchant that accepts AP2 lists dev.ucp.common.payment.ap2_mandate there.^{Source [11]}
3. Create checkout (UCP). Gemini calls POST /checkout-sessions with its profile URI in UCP-Agent.^{Source [9, 12]} Google says requests from its surfaces carry UCP-Agent and a User-Agent beginning with Google/UCP.^{Source [2]} If AP2 is in the capability intersection, the session is locked and neither side may fall back to an unprotected checkout.^{Source [4]}
4. Signed checkout (UCP AP2 extension). The merchant must include ap2.merchant_authorization in every checkout response, a JWS with detached content over the checkout without the ap2 field.^{Source [4, 13]}
5. Verify and hand off (AP2). Gemini must verify the merchant signature before showing the checkout.^{Source [4]}
6. Approve (AP2). In the human-present flow the user approves the closed Checkout and Payment Mandates on a Trusted Surface.^{Source [8, 14]}
7. Get the credential (UCP handler). The credential provider defines the handler, the merchant configures it, and the platform executes it to obtain a token.^{Source [9]} On Google AI surfaces UCP checkout supports only PAN_ONLY for Google Pay allowed_auth_methods.^{Source [2]}
8. Create the closed mandates (AP2, per spec). The Checkout Mandate requires vct, checkout_jwt and checkout_hash.^{Source [15]} The Payment Mandate requires vct, transaction_id, payee, payment_amount and payment_instrument, and transaction_id is the hash of checkout_jwt, which binds payment to one checkout.^{Source [16]}
9. Complete (UCP). The checkout mandate goes in ap2.checkout_mandate, an SD-JWT with key binding, and the payment mandate in payment.instruments[*].credential.token.^{Source [4, 13]} UCP signs requests with RFC 9421 and binds bodies with an RFC 9530 Content-Digest.^{Source [17]}
10. Merchant verifies (AP2). The merchant checks that the hash of the checkout JWT it sent matches checkout_hash.^{Source [8]}
11. Processor verifies (AP2). The Merchant Payment Processor checks that the credential is scoped to this checkout, for example by finding the closed Payment Mandate inside it.^{Source [8]}
12. Authorize (card rails). The merchant’s PSP must be able to process Google’s tokens; the merchant does not need Google Pay on its own site.^{Source [2]}
13. Order and receipts (UCP, AP2). Complete returns completed with an order.^{Source [18]} Per AP2 the processor returns a signed Payment Receipt and the merchant a signed Checkout Receipt.^{Source [8, 14]}
14. Order webhooks (UCP). The merchant posts full order snapshots to the platform’s config.webhook_url with Webhook-Id and Webhook-Timestamp.^{Source [12, 19, 20]} Webhooks must be signed with RFC 9421, and the platform must reject events whose signer does not match the order’s business.^{Source [20]}

Which protocol does what

AP2 v0.2 was released on 2026-04-28.^{Source [21, 22]} The UCP release that renamed the AP2 extension to dev.ucp.common.payment.ap2_mandate is v2026-08-25.^{Source [13, 23, 24]}

Where controls apply

• Before authorization. The platform allowlists businesses and capability namespaces and checks the advertised handlers before it creates a checkout.^{Source [9]} UCP has no spending cap field; caps belong to AP2 mandates or the credential provider.^{Source [4, 25]}
• At signing. Consent binds to one merchant-signed checkout. The checkout mandate contains the full checkout including ap2.merchant_authorization, so the platform’s signature covers the merchant’s.^{Source [4]} Without AP2, the agent must hand the checkout to a trusted, deterministic UI for the user to review and place the order.^{Source [18]}
• At the edge. With API keys, OAuth or mTLS, the merchant must confirm that the caller may act for the profile in UCP-Agent.^{Source [9]} Replay protection rests on a signed Idempotency-Key.^{Source [17]}
• At settlement. PSP fraud screening applies, and 3DS stays with the business, handler and PSP rather than in UCP messages.^{Source [26]} AP2 v0.2 specifies no step-up; a failed check falls back through unresolved_constraint.^{Source [14, 27]}
• After the fact. AP2 dispute verification recomputes the checkout_jwt hash and checks both receipt references against the closed mandates.^{Source [8]} Order adjustments can record disputes, but handling them stays with the merchant and its PSP.^{Source [19]}

What is observable from outside

Business profiles are public and cacheable, so anyone can see the capabilities, transports, payment handlers and keys a domain advertises, including whether it accepts AP2.^{Source [9]} The rest is private. Checkout sessions, payment credentials, mandates and webhooks flow point to point.^{Source [9]} AP2 defines no public registry, explorer or event stream.^{Source [8, 28]} Google keeps the order data shown on the shopper’s My orders page until the shopper asks for deletion.^{Source [2]}

What can go wrong

• Unsigned or altered checkout. A missing or invalid merchant signature yields merchant_authorization_missing or merchant_authorization_invalid.^{Source [13]} No order is placed and nobody pays.
• Mandate problems. A missing mandate yields mandate_required; an expired, mis-scoped or badly signed one yields mandate_expired, mandate_scope_mismatch or mandate_invalid_signature.^{Source [13]}
• Lost complete response. During complete_in_progress the platform must not start another update or complete.^{Source [18]}
• Escalation. With requires_escalation the business must provide continue_url, and the platform must send the shopper there.^{Source [18]}
• Wrong item or price. The merchant is merchant of record and carries the order; the shopper accepted the merchant’s terms during checkout.^{Source [2]} AP2 leaves liability to the payment networks.^{Source [6, 29]}
• Forged webhook. The platform must reject events whose signer is not the order’s business.^{Source [20]}

Costs: Google publishes no fee schedule; because the merchant uses its own PSP, its normal processing fees presumably apply, which is an inference, not a statement from Google.^{Source [2]? unverified} Google told The Register it does not plan to take a cut of sales.^{Source [30]}

Variants

• A network token instead of a card on file. UCP defines a network_token credential with number and cryptogram.^{Source [31]} On Google surfaces, though, a network-token path through the Google Pay handler is not documented, because only PAN_ONLY is supported there.^{Source [2]} Which network’s agentic token, if any, could flow inside a Google Pay handler is not published.^{Source [2]? unverified}
• Without AP2, as documented today. Drop steps 5, 8, 10 and 11: the checkout goes to a trusted UI for review, and UCP’s own signatures and idempotency carry the integrity.^{Source [18]} Google also offers approved merchants an embedded checkout as an alternative to native checkout.^{Source [32]}