Google UCP Integration

Overview

The Universal Checkout Protocol (UCP) enables autonomous shopping agents to complete purchases on behalf of consumers. By integrating Forter's Tokenization with UCP, merchants can securely accept payments from AI agents without handling raw card data.

Setup

Add the Forter tokenization handler to your /.well-known/ucp endpoint:

Sandbox

{
  "payment": {
    "handlers": [
      {
        "id": "forter_tokenizer",
        "name": "com.forter.tokenizer",
        "version": "2026-01-14",
        "spec": "https://pci-tokenization-sandbox.checkouttools.com/v1/agentic/ucp/tokenizer_spec",
        "config_schema": "https://pci-tokenization-sandbox.checkouttools.com/v1/agentic/ucp/tokenize_schema.json",
        "instrument_schemas": [
          "https://ucp.dev/schemas/shopping/types/card_payment_instrument.json"
        ],
        "config": {
          "endpoint": "https://pci-tokenization-sandbox.checkouttools.com/v1/agentic/ucp/tokenize",
          "identity": {
            "access_token": "YOUR_FORTER_UCP_API_KEY",
            "site_id": "YOUR_FORTER_SITE_ID"
          }
        }
      }
    ]
  }
}

Production

{
  "payment": {
    "handlers": [
      {
        "id": "forter_tokenizer",
        "name": "com.forter.tokenizer",
        "version": "2026-01-14",
        "spec": "https://pci.checkouttools.com/v1/agentic/ucp/tokenizer_spec",
        "config_schema": "https://pci.checkouttools.com/v1/agentic/ucp/tokenize_schema.json",
        "instrument_schemas": [
          "https://ucp.dev/schemas/shopping/types/card_payment_instrument.json"
        ],
        "config": {
          "endpoint": "https://pci.checkouttools.com/v1/agentic/ucp/tokenize",
          "identity": {
            "access_token": "YOUR_FORTER_UCP_API_KEY",
            "site_id": "YOUR_FORTER_SITE_ID"
          }
        }
      }
    ]
  }
}

Contact your Forter account team to obtain a UCP API key.

Processing Payments

When a shopping agent completes checkout, your backend receives a Forter token instead of raw card data. To process the payment, route it through Forter's Detokenization Proxy, which resolves the token and forwards the request to your payment processor.

The proxy enforces token binding, ensuring tokens can only be used by the merchant they were issued to.