écentic for WooCommerce

écentic for WooCommerce connects your store to the Universal Commerce Protocol so AI shopping assistants (Google Gemini AI Mode, ChatGPT Shopping, and any UCP-compatible agent) can discover, browse, and purchase from your store — no screen-scraping, no custom integrations.

The heavy UCP protocol surface — capability negotiation, catalog search, cart and checkout sessions, payment handling, idempotency, RFC 9421 request/response signing, and order webhooks — is served by écentic on your store’s behalf. This plugin is the store-side half:

On your domain:

• /.well-known/ucp — the UCP discovery profile (cached proxy of your hosted profile, so agents always discover you at your own URL)
• /.well-known/oauth-authorization-server — OAuth 2.0 metadata (RFC 8414) for UCP identity linking
• /ucp-oauth/authorize|token|revoke — the identity-linking authorization server: your customers log in and grant consent on your site, never on a third party
• /ucp-connect/* — the one-click écentic connection (OAuth 2.0 + PKCE; the API secret never travels through a browser)

For the écentic backend (private, key-authenticated bridge):

• Live cart math — quotes run on a real WooCommerce cart, so your tax tables, shipping zones, coupons, and any third-party pricing plugins all apply
• Order creation through the native WooCommerce checkout internals
• Optional server-side payment processing via the WooCommerce Stripe Gateway (your Stripe secret key never leaves this site)
• Order entity snapshots, user-token introspection, and store policy (legal pages, page URLs, payment handlers, access rules)

Merchant controls (WooCommerce → UCP (AI Agents)):

• Enable/disable the whole UCP surface
• Require RFC 9421 signed requests
• Store-level API key (X-UCP-Key)
• Allow-list of agent platforms permitted to transact (identity binding)
• Per-agent rate limit
• Include/exclude out-of-stock products from the agent catalog
• Google Pay payment handler declaration (merchant ID + PSP gateway)
• Server-side Stripe charging (off by default; payment otherwise defers to your trusted checkout)

Settings apply to the hosted endpoints immediately on save.

Also included:

• Order lifecycle webhooks to agent platforms (order.created, order.updated) with Standard Webhooks headers and RFC 9421 signatures, relayed through écentic
• Full support for variable products, coupon codes (with per-line discount allocations), and live shipping options
• HPOS (custom order tables) and cart/checkout blocks compatible
• Extensible: ecentic_ucp_process_instrument (custom payment processors), ecentic_ucp_payment_handlers, ecentic_ucp_identity_scopes, ecentic_ucp_stripe_secret_key

External services

This plugin relies on the following third-party services. No data is transmitted to any of them until you explicitly connect the store (see Installation) or explicitly enable the feature described.

écentic (ecentic.ai) — required

écentic is the hosted backend that serves this store’s UCP protocol surface: capability negotiation, catalog search, cart and checkout sessions, payment handling, RFC 9421 request signing, and order webhooks to AI agent platforms. The plugin is the store-side half of that service; the store cannot be served to AI agents without it.

• What is sent, and when. Nothing is sent on installation or activation. When you click Connect to ecentic.ai on the settings screen, your store URL, REST API URL, and site name are sent to start the OAuth 2.0 connection. If you approve it, écentic receives a WooCommerce REST API key that you issued, and from then on it reads your product catalog and store policy (currency, shipping options, legal page URLs, payment handler declarations, and your UCP settings) as agents request them, and receives the orders that AI agents place through it (line items, totals, and the buyer’s shipping and contact details needed to fulfil the order). Your store also serves écentic’s copy of your discovery profile at /.well-known/ucp, refreshing it about every 5 minutes.
• What is never sent. Payment secrets (such as your Stripe secret key), customer passwords, and the WooCommerce database itself stay on your site.
• Service provided by écentic: Terms of Service, Privacy Policy.

Stripe (api.stripe.com) — optional, off by default

Only used if you tick Server-side Payments (Stripe) on the settings screen and have the WooCommerce Stripe Gateway configured. When an AI agent completes a checkout, the plugin calls Stripe’s PaymentIntents API from your server to charge the payment method the buyer authorised, sending the payment token, the order amount and currency, and the order number. The call is made with the Stripe secret key already configured on your own site — the key never leaves your server, and no request is made to Stripe while the setting is off.

• Service provided by Stripe: Terms of Service, Privacy Policy.

Google Pay — optional, declaration only

If you enter a Google Pay merchant ID in the settings, the store advertises a Google Pay payment handler in its UCP profile, referencing Google’s published handler schema URL. The plugin itself makes no request to Google and sends Google no data; any Google Pay interaction happens between the buyer’s AI agent and Google.

• Service provided by Google: Terms of Service, Privacy Policy.