UCP v2026-04-08: Signed Commerce, Split Catalogs, and What Changes for Your Store

Name: Colter
Author: Colter

Google released UCP v2026-04-08 yesterday. Six breaking changes, three new capability types, and a cryptographic signing system that will reshape how AI agents pick which stores to shop at.

Shopify is auto-deploying it to all storefronts. If you're on Shopify, your manifest updates without you doing anything. If you're not, you have work to do.

What's New

Cryptographic signing. Stores can now sign UCP requests and responses. An AI agent shopping on your store can verify that the price it sees is the price you set — not something modified in transit. Agents will prefer signed stores for the same reason browsers prefer HTTPS: trust. This is optional today. It won't be optional for long.

Cart is now a real capability. Add to cart, remove, update quantities, apply discounts — all through a standardized API with its own schema. Before this release, cart operations were platform-specific hacks. Now they're part of the protocol.

Catalog splits into search and lookup. Search returns filtered product lists. Lookup returns one product by ID. Agents can now declare which operations they need, and stores can declare which they support.

Discounts work in carts. Promotional codes and pricing rules can be applied through the cart API, not just at the checkout step.

Eligibility claims. Stores can declare that certain products require verification — age, geography, membership. Agents check eligibility before attempting a purchase instead of failing at checkout.

Breaking Changes

Six in this release — more than any previous update.

Currency required on orders. The order schema now requires a top-level currency field. Manifests without it are non-compliant.
Transport bindings renamed and versioned. How services declare capabilities in the manifest changed. Parsers built for v2026-03-19 may not recognize the new format.
Structured errors for checkout and cart. Agents get typed error responses instead of generic failures.
Authorization signals. New structure for how stores communicate auth requirements and abuse prevention.
Signed amounts on totals. Order totals now reference signed_amount.json.
Deprecated schemas removed. Transition-period schemas from earlier releases are gone.

What You Need to Do

Shopify merchants

Nothing. Shopify auto-deploys the update. But you should:

Run a check to confirm your manifest reflects the new capabilities
Enable signing if Shopify surfaces a toggle in checkout settings — signed stores rank higher in agent discovery
Test custom cart apps to make sure they work with the standardized cart operations

Everyone else

Update your manifest manually:

Version → 2026-04-08
Add currency to order capability config
Match the new transport binding format
Add signing support (recommended)
Split catalog into search and lookup declarations

The Maturity Model

UCP adoption now has five levels. Where your store sits determines how much agents can do on it — and how much they'll want to.

Level 1: Present           UCP manifest exists
Level 2: Transactional     + checkout capability
Level 3: Full Commerce     + cart + catalog
Level 4: Personalized      + identity linking
Level 5: Trusted Commerce  + cryptographic signing     ← new

Most Shopify stores will land at Level 3 or 4 after the auto-deploy. Level 5 requires signing, which is new and not yet default.

The gap between Level 4 and Level 5 is where competitive advantage lives right now.

Colter Is Updated

All four products now support UCP v2026-04-08. Here's what shipped:

Check — The scanner now detects signing support, discount capabilities, and the catalog search/lookup split. It also flags manifests with missing currency fields on order capabilities, which is a compliance issue under the new spec. Both the old v2026-03-19 format and the new v2026-04-08 transport binding structure are handled — no false negatives during the transition.

Fix — Generated manifests now target v2026-04-08. Order capabilities include the required currency field. Discount is auto-included when cart is present (per the spec). If you opt into signing, Colter generates the signing key structure and capability declaration. The CLI supports this with colter fix <url> --type ucp --signing.

Scoring — Signing adds meaningful points across both the transaction and ecosystem dimensions. Stores with full signing support can now reach Level 5 (Trusted Commerce) in the maturity model, which scores higher than Level 4 (Personalized). The capability scoring cap was raised to accommodate the new capability types. Existing stores at v2026-03-19 see no score regression — all changes are additive.

Lens — Agent interactions are tracked across the new capability types, including cart operations and catalog lookups.

Run a free check →

Why This Release Matters

Three UCP releases in four months. Each one adds capabilities that make AI shopping agents more functional. Cart operations, catalog search, identity, and now signed data.

The signing piece is the one to watch. When agents can cryptographically verify that your store's product data and prices are authentic, they'll route transactions to you over stores they can't verify. Same pattern as HTTPS adoption — optional, then expected, then required. We're in the "optional" window now.