← All articles
11 min read

How to Add UCP to Shopware (There Is a First-Party Plugin)

Shopware speaks UCP. That one sentence is the whole difference between this guide and the Magento one, where the answer was “there is nothing native, build the bridge yourself.” Shopware maintains a first-party agentic-commerce plugin that publishes the discovery document and serves the shopping capabilities over four transports.

So the job changes shape. You are not implementing a protocol against service contracts — you are installing an extension, deciding which sales channels are exposed, and getting the auth surface right. That last part is where the real work moved, and it is the part a quick-start guide will not tell you about.

AI agentGemini · Copilot/.well-known/ucpthe profileREST/ucp/v1A2A/ucp/a2aEmbedded/ucp/embedded/*MCP (6.7+)/ucp/mcpagentic-commercefirst-party pluginucp-php-sdkShopwareCart · OrderCatalog · CustomerSigned requests · agent allowlist · idempotency · signing keysconfigured per sales channel, not per store
The plugin sits between the agent and Shopware's own services. You configure the front door and the trust rules; the SDK owns the protocol semantics.

What UCP is, in one paragraph

UCP (Universal Commerce Protocol) is an open, Apache-2.0 standard for how AI agents transact with stores — announced by Google and Shopify at NRF in January 2026, backed by Amazon, Walmart, Target, Stripe, Meta and Salesforce. It models a store as a set of capabilities in reverse-DNS namespaces (dev.ucp.shopping.catalog, dev.ucp.shopping.checkout, and so on), each reachable over a transport of your choosing. If you want the protocol itself explained from the spec — the endpoint shapes, the session state machine, the AP2 payment leg — that is all in the Magento guide, and it is platform-independent. This piece is about the Shopware side.

What Shopware actually ships

The plugin covers three separate surfaces, and it is worth keeping them apart in your head because they fail and get configured independently.

SurfaceWhat it doesEndpoints
UCPThe transactional protocol: catalog, cart, checkout, order, customer identity, payment/.well-known/ucp
Native discoveryPlain documents that tell a crawler or agent what the store is, without transacting/agents.md, /llms.txt, /.well-known/ai-catalog.json
Product feedsCatalog ingestion for agents that read feeds rather than call APIsOpenAI JSONL + Google Shopping XML, via Shopware’s export infrastructure
Your Shopwaresales channelUCP/.well-known/ucpthe agent buysNative discovery/agents.md · /llms.txt · /.well-known/ai-catalog.jsonthe agent understandsProduct feedsOpenAI JSONL · Google Shopping XMLthe agent ingests
Three surfaces, three different jobs. A store can publish discovery and feeds without ever accepting an agent transaction — and plenty should start there.

It supports 6.5.x, 6.6.x and 6.7+ from one codebase, and it feature-detects at runtime: capabilities and transports your version cannot actually serve are removed from the published profile rather than advertised and then failing. That is the right behaviour and worth knowing, because it means two stores on the same plugin version can legitimately publish different profiles.

Four transports, one of them version-gated

TransportPathAvailability
REST/ucp/v1All supported lanes
A2A/.well-known/agent-card.json + /ucp/a2aAll supported lanes
Embedded/ucp/embedded/*All supported lanes — but see the origin rules below
MCP/ucp/mcp6.7+ only
RESTA2AEmbeddedMCPShopware 6.5.xShopware 6.6.xShopware 6.7+Unsupported transports are removed from the published profile, not advertised and then failed.
The only version-gated transport. Everything else works the same across supported lanes.
If you are on 6.5 or 6.6 and MCP matters to you
The MCP transport simply will not appear in your profile. That is not a misconfiguration to debug — it is feature detection doing its job. Either move to 6.7+, or reach agents over REST and A2A, which are first-class UCP transports and not a downgrade.

Installing and turning it on

The plugin installs through Shopware’s normal extension mechanism and resolves its own Composer dependencies during the plugin lifecycle — it pulls the UCP PHP SDK (ucp-php-sdk/symfony-bundle) as a required runtime dependency. There is no “installed but UCP disabled” mode: without the SDK the plugin does not boot.

Exposure is then per sales channel, set in the Administration under the Agentic Commerce section: activate the channel, set the profile domain, and choose which capabilities and transports to publish. Everything else is CLI:

# which channels are exposed, and how
bin/console ucp:channels

# the resolved config for one channel
bin/console ucp:config:show --sales-channel=Storefront

The configuration that actually matters

ucp:config:set is where the security posture lives. Omit the options you are not changing — passing none at all is an error rather than a no-op.

OptionWhy you care
--signature-policy=strict|log|offThe single most important flag. log is for bringing a channel up; production wants strict.
--idempotency=true|falseWhether a retried agent request can place a second order. Leave it on.
--agent-allowlist=<host>Repeatable, bare hosts with no scheme. Which agents may transact at all.
--remote-profile-allowlist, --platform-allowlistThe other two trust lists — separate knobs, easy to conflate.
--embedded-allowed-origins, --embedded-frame-ancestorsRepeatable, with scheme. Required for embedded pages — both of them.
--webhook-url-override=<https-url>Point shipment events somewhere other than the default. Empty value clears it.
--continue-url-template=<url>Where a shopper lands to finish in your storefront. Supports {checkoutId}, {cartId}, {salesChannelId}.
bin/console ucp:config:set --sales-channel=Storefront \
    --embedded-allowed-origins=https://chatgpt.com \
    --embedded-frame-ancestors=https://chatgpt.com \
    --idempotency=true
Agent requestsignedSignature policystrict | log | offAgent allowlistbare hostsIdempotencyno double orderOrder placedin Shopwarecontrolled 403 UCP responsenot a crash, not a blank page
This is where the work moved. The plugin builds the protocol; you decide who gets through these three gates.
The embedded gotcha, stated plainly
Embedded pages need both the allowed origins and the frame ancestors set. A request arriving with no Origin header, or from an origin that is not on the list, gets a controlled 403 UCP response — not a crash, not a blank page. If embedded checkout “does nothing” in an agent, this is the first thing to check, and the 403 body will tell you.

Signing keys are per channel, and they rotate

Requests are signed with tenant-scoped keys managed per sales channel. Generate them, publish the public half, and retire rather than delete when rotating, so in-flight verifications do not fail:

bin/console ucp:signing-keys:generate    --sales-channel=Storefront
bin/console ucp:signing-keys:list       --sales-channel=Storefront
bin/console ucp:signing-keys:show-public --sales-channel=Storefront
bin/console ucp:signing-keys:retire     --sales-channel=Storefront
bin/console ucp:signing-keys:delete     --sales-channel=Storefront

There is also SDK-provided storage maintenance you should schedule rather than discover later, particularly the signature-nonce cleanup:

bin/console ucp:storage:cleanup
bin/console ucp:storage:cleanup-signature-nonces --older-than-seconds=86400

Shopware vs Magento, side by side

If you run both — plenty of merchants do — this is the honest comparison of what it takes to be agent-reachable on each.

ShopwareMagento / Adobe Commerce
First-party UCP supportYes — maintained pluginNo
Discovery documentPublished for you, per sales channelYou build the controller
Checkout session mappingIn the plugin, on top of the UCP PHP SDKYou map Quote ↔ session by hand
TransportsREST, A2A, embedded, MCP (6.7+)Whatever you implement
Customer identityCovered as a capabilityOAuth 2.0 + PKCE you add yourself (Magento’s integration OAuth is 1.0a)
Multi-store scopingNative — per sales channelYou design it
Your main jobConfiguration, trust rules, key rotationBuilding the module, then all of the above

The gaps you still own

A community alternative exists
agentic-commerce-lab/SwagUcp is a separate community Shopware plugin covering similar ground — checkout sessions over REST, the discovery endpoint, EC P-256 webhook signing, domain allowlisting. Worth knowing about if the first-party plugin does not fit your lane, though for most merchants the maintained one is the right default.

Where WisWes fits

The two things solve different halves of the problem. UCP makes your store transactable by an agent that arrives from outside — from Gemini, Copilot Checkout, or a shopping agent that found you through a feed. WisWes is the assistant on your own storefront, talking to the shopper who is already there: catalog search, comparison, cart, and order questions, reaching Shopware in-process through the Store API. Turning on UCP does not replace that conversation, and running that conversation does not make you discoverable to external agents. If you are deciding where to spend first, the honest answer depends on whether your traffic problem is reach or conversion — and most stores know which one hurts.

FAQ

Does Shopware support UCP out of the box?
Shopware maintains a first-party agentic-commerce plugin — so it is a supported extension rather than something in core you flip on. Install it, activate the sales channels you want exposed, and it publishes /.well-known/ucp for you.

Which Shopware versions can do this?
6.5.x, 6.6.x and 6.7+ are supported from a single codebase. REST, A2A and embedded work across all of them; the MCP transport is 6.7+ only.

Do I have to expose my whole store?
No — exposure is per sales channel, and within a channel you choose which capabilities and transports to publish. A single B2C channel can be agent-reachable while your B2B channel is not.

What is the one setting people get wrong?
Leaving --signature-policy on log after going live. It is the right setting while bringing a channel up and the wrong one to keep. The second is forgetting that embedded needs both --embedded-allowed-origins and --embedded-frame-ancestors.

Is it worth doing now?
The discovery document and feeds are cheap and make you visible to agents that would otherwise skip you. The transactional surface deserves a real look at your signature policy and allowlists before you turn it on in production — which, given the plugin does the building for you, is where your time should go anyway.

Details here reflect the plugin’s documentation as of August 2026. UCP is date-versioned and moving quickly — verify command flags and endpoint paths against the repository before you build on them.

WisWes is an AI sales assistant for Shopware, Magento, and Shopify — the assistant on your storefront, alongside whatever agents arrive from outside.

Turn questions into checkout.

WisWes drops into your store and guides shoppers from browsing to buying. 14-day free trial — no card.