Article image
The Agentic Web: Managing Client MCP, ACP, AP2, and UCP Credentials
For decades, e-commerce web design meant building for human eyes: layout, button placement, micro-copy, checkout funnels. A shopper searched, clicked, typed a card number, and hoped nothing broke along the way.
That assumption no longer holds. Commerce is shifting toward an agentic model, where a person asks an AI assistant — ChatGPT, Gemini, Claude, Copilot, or a browser-based agent — to find, compare, and complete a purchase on their behalf. Instead of a human clicking through a storefront, an agent calls structured tools the website exposes directly. When one of those tools hits a broken endpoint or an expired credential, the transaction doesn't get a confused human trying again — it just fails, silently, and the agent moves to a competitor.
By late 2026, this isn't a single protocol. It's a small stack of competing and overlapping open standards — MCP, WebMCP, ACP, AP2, and UCP — each governing a different layer of the agent-to-merchant relationship, each with its own credentials, its own authentication model, and its own failure modes. For web agencies, understanding which protocol does what — and which piece of the resulting credential sprawl a renewal-tracking tool like InstaRenewal actually helps with — has become a real piece of 2026 operational literacy.
- The 2026 Agentic Protocol Stack Five specifications currently define how AI agents discover, negotiate with, and transact against a merchant's systems. They aren't competitors so much as layers that compose with each other:
┌──────────────────────────────────────────────────────────┐
│ Agent / Client Surface │
│ (ChatGPT, Gemini + AI Mode, Claude, Copilot, browser) │
└───────────────────────────┬───────────────────────────────┘
│
┌───────────────────────────▼───────────────────────────────┐
│ Full Commerce Journey — UCP (Google + Shopify) │
│ Discovery → capability negotiation → checkout → post- │
│ purchase, merchant stays Merchant of Record │
└───────────────────────────┬───────────────────────────────┘
│
┌───────────────────────────▼───────────────────────────────┐
│ Checkout Layer — ACP (OpenAI + Stripe) │
│ Session-scoped checkout API; composes with UCP and MCP │
└───────────────────────────┬───────────────────────────────┘
│
┌───────────────────────────▼───────────────────────────────┐
│ Payment Authorization — AP2 (Google + 100+ partners) │
│ Signed Mandates prove the agent had real user authority │
└───────────────────────────┬───────────────────────────────┘
│
┌───────────────────────────▼───────────────────────────────┐
│ Tool / Data Layer — MCP (server-side) + WebMCP (browser) │
│ How the agent reads inventory, calls functions, and acts │
└──────────────────────────────────────────────────────────┘
A. Model Context Protocol (MCP) — the connectivity layer
Anthropic open-sourced MCP in late 2024 as a universal way for AI applications to connect to external tools and data. On December 9, 2025, Anthropic donated MCP to the newly formed Agentic AI Foundation (AAIF), a Linux Foundation project also backed by OpenAI, Google, Microsoft, Amazon, Block, Cloudflare, and Bloomberg — putting the protocol's governance under an open, vendor-neutral foundation rather than a single company. The stable specification was published November 25, 2025, with a release-candidate for the next version dated July 28, 2026, and a policy of at least a twelve-month grace window before any feature is deprecated. Anthropic reported the protocol crossing 97 million monthly SDK downloads and over 10,000 active public servers by March 2026.
For agencies, the practical detail is authentication: the 2025-03-26 spec revision made OAuth 2.1 with PKCE the standard for any MCP server exposed over HTTP, built on RFC 9728 (Protected Resource Metadata, so a client can discover a server's auth requirements) and RFC 7591 (Dynamic Client Registration, so agents don't need to be manually pre-registered with every server). Access tokens under this model are typically short-lived and paired with refresh tokens — there's no single universal rotation window the way there is for, say, a certificate. A local, stdio-based MCP server (running as a subprocess on a machine) doesn't need this at all; it inherits the OS-level permissions of whoever's running it, which is its own, different risk.
B. WebMCP — the browser-native layer
WebMCP is not yet a finished standard. It's a Draft Community Group Report under the W3C Web Machine Learning Community Group (not the "Working Group" — an important distinction, since Community Group output isn't on the formal W3C standards track), first published February 10, 2026 and led by engineers from Google and Microsoft. It defines a browser API, navigator.modelContext, that lets a web page register JavaScript functions as tools — searchProducts(), addToCart(), and so on — that an in-browser agent can discover and call directly, without screen-scraping or fragile CSS selectors.
Chrome 146 (Canary) shipped an early implementation of navigator.modelContext in February 2026, making Chrome the first browser with native support. As of this writing, Edge is expected to follow given its shared engine, while Firefox and Safari are engaged in the spec discussion but haven't committed to a timeline — so a site can't yet assume WebMCP is universally available and needs a fallback path. WebMCP tools run client-side, inherit the visitor's authenticated session, and don't require a separate server or API key to manage — which also means the credential-fragility problem described below is largely a server-side MCP and commerce-protocol issue, not a WebMCP one.
C. Agentic Commerce Protocol (ACP) — the checkout layer
OpenAI and Stripe co-developed ACP and released it under Apache 2.0 on September 29, 2025, alongside ChatGPT's Instant Checkout feature. The design lets an agent collect a buyer's payment selection and hand the merchant a narrowly scoped Shared Payment Token — issued through Stripe's Shared Payment Token API — rather than the buyer's actual card number, while the merchant keeps its status as Merchant of Record: it still sets pricing, controls branding, and handles fulfillment and disputes.
Instant Checkout launched with Etsy and added a handful of Shopify brands (Glossier, Vuori, Spanx, SKIMS) in its first weeks, and PayPal joined as a supported payment provider on October 28, 2025. It's worth being precise about what happened next: Instant Checkout itself was retired in March 2026, after only around a dozen Shopify merchants had ever shipped against it — a smaller footprint than the initial announcement suggested. The ACP specification kept going regardless, maintained through a Specification Enhancement Proposal (SEP) process on GitHub; the latest stable release (dated 2026-04-17) added cart, product feed, order, authentication, and MCP-compatibility support, and Stripe shipped a broader Agentic Commerce Suite on December 11, 2025. In practice, ACP today functions less as a single consumer-facing feature and more as the checkout-session building block other surfaces — including UCP, below — can call.
D. Agent Payments Protocol (AP2) — the authorization layer
Google announced AP2 on September 16, 2025 with more than 60 launch partners, including Mastercard, PayPal, American Express, Adyen, Coinbase, and Salesforce; by the time PayPal and Google Cloud announced a joint Conversational Commerce Agent on October 27, 2025, the coalition had grown past 100 organizations. AP2 solves a narrower, specific problem than ACP or UCP: proving that an agent's purchase actually reflects what the user authorized. It does this with a chain of cryptographically signed Mandates (an Intent Mandate capturing what the user asked for, a Cart Mandate capturing what the agent assembled, and a Payment Mandate authorizing the charge), represented as W3C Verifiable Credentials. AP2 is payment-method agnostic — cards, bank transfers, real-time rails, and stablecoins are all supported extension points — and is explicitly designed to compose with both MCP and Google's Agent2Agent (A2A) protocol rather than replace either. Version 0.2.0 shipped in April 2026, and Google has since moved AP2's community governance toward the FIDO Alliance. Most retailers don't integrate AP2 directly; it's typically handled by the payment processor or network sitting behind whichever checkout protocol (ACP or UCP) the merchant actually implements.
E. Universal Commerce Protocol (UCP) — the full-journey layer
The newest entrant, and — as of September 2026 — arguably the most consequential for retailers. Google and Shopify co-developed UCP and announced it on January 11, 2026 at the National Retail Federation's NRF conference, with more than 20 endorsing retailers and payment companies (Etsy, Wayfair, Target, Walmart, Best Buy, Macy's, The Home Depot, Visa, Mastercard, Stripe, Adyen, American Express). Where ACP scopes itself narrowly to the checkout session, UCP covers the entire journey — product discovery, capability negotiation, checkout, and post-purchase order tracking — through a single specification, released under Apache 2.0. It's already wired into Google's AI Mode in Search and the Gemini app, and into a Microsoft Copilot Checkout integration, and it composes with both MCP (for tool/data connectivity) and AP2 (for payment authorization) rather than reinventing either.
- The Operational Challenge: Credential Fragility Across Five Protocols The core problem agencies now face isn't any single credential — it's that a production-grade agentic storefront depends on a chain of independent, differently-behaved authentication systems layered across these protocols:
[Agent Request] → [MCP/WebMCP tool auth] → [ACP or UCP checkout session]
→ [AP2 Mandate signature check] → [PSP-level payment auth] → [Order confirmed]
If any single link in that chain lapses, the failure is rarely loud. A human shopper hitting an expired SSL certificate sees a broken-page warning; an agent hitting an expired MCP bearer token, an unconfigured OAuth scope, or a lapsed ACP merchant credential typically just gets a 401 or 429 response, reports the item as unavailable, and quietly tries a competitor. Nothing about that failure shows up in a human-facing uptime check.
This isn't a hypothetical risk category. Credential sprawl tied specifically to AI services has been accelerating faster than the rest of the software supply chain: GitGuardian's 2026 State of Secrets Sprawl report — based on a scan of public GitHub activity plus enterprise incident-response data — found leaked secrets tied to AI services jumped 81% year-over-year in 2025, reaching just over 1.27 million exposed credentials, against a backdrop of 28.6 million total hardcoded secrets found on public GitHub that year. The same report found that 64% of secrets confirmed valid in 2022 were still active and exploitable as of January 2026 — old, forgotten keys don't stop being a risk just because nobody's looked at them recently.
- The Protocol Credential Landscape Credential / Asset Protocol Layer Function Typical Lifecycle Failure Impact MCP OAuth 2.1 access + refresh tokens MCP (Tool/Data) Authenticates agents calling tools on a remote MCP server Short-lived access token, longer-lived refresh token (provider-configured, not a fixed universal window) Agent loses tool access; local calls fail with 401 WebMCP tool registration WebMCP (Browser) Exposes page functions to an in-browser agent via navigator.modelContext Tied to the page session, not a standalone credential Agent falls back to screen-scraping or fails silently ACP Shared Payment Token ACP (Checkout) Narrowly scoped, merchant- and session-specific payment token Single checkout session Checkout session fails; no persistent key to rotate ACP merchant/API credentials ACP (Checkout) Authenticates the merchant's backend to the ACP checkout API Provider-managed (Stripe-issued) Agent-initiated checkout requests are rejected AP2 Mandate signing keys AP2 (Authorization) Signs Intent/Cart/Payment Mandates as Verifiable Credentials Managed by the issuing wallet/processor, not the merchant Mandate verification fails; payment network declines the transaction UCP merchant capability manifest UCP (Full Journey) Declares what a merchant supports for discovery, negotiation, checkout Merchant-maintained, versioned with the catalog feed Agent can't discover or transact with the merchant at all
- Step-by-Step SOP: Keeping an Agentic Storefront Authenticated Step 1: Map which protocols actually touch the storefront. Not every merchant needs all five. A content site might only need MCP for internal tooling; a Shopify merchant selling through Google AI Mode needs UCP; one still running legacy ChatGPT integration work needs to know that Instant Checkout itself is gone even though ACP as a spec continues.
Step 2: Isolate credentials per environment and per client. Never share one global MCP bearer token or ACP merchant key across multiple client deployments. Where the underlying provider supports it, use project- or workspace-scoped credentials so a rotation or revocation on one client's integration can't take down another's.
Step 3: Configure OAuth 2.1 correctly on any MCP server exposed over HTTP. Confirm Protected Resource Metadata (RFC 9728) is published so clients can discover auth requirements, and confirm PKCE is enforced — the spec treats this as mandatory, not optional, for production servers.
Step 4: Publish (and monitor the underlying cert for) a discovery manifest. A handful of MCP servers now publish a JSON manifest at /.well-known/mcp/server-card.json — with /.well-known/mcp.json circulating informally as a compatibility alias — describing the server's endpoint and auth requirements; an IETF Internet-Draft (draft-serra-mcp-discovery-uri) proposes formalizing this, but as of September 2026 it remains a draft, not a ratified standard, so treat any specific discovery path as provisional rather than guaranteed stable.
Step 5: Build in fallback behavior, not just alerting. Because agent-facing failures are silent to humans, the application layer — not a human noticing a broken page — has to be the thing that catches a 401 or 429 and either retries, fails over, or surfaces the problem to an engineer.
Step 6: Run a fixed-cadence audit, separate from real-time monitoring: reconcile which client integrations are still active against which protocols they actually use, revoke stale test credentials, and confirm the domains, SSL certificates, and hosting accounts behind every agent-facing endpoint are still current and correctly owned.
- Where InstaRenewal Fits — and Where It Doesn't It's worth being precise here, the same way it's worth being precise about which protocol does what, because "agentic commerce infrastructure" is exactly the kind of sprawling category that invites overselling any one tool's role in it.
InstaRenewal is a manual renewal-date and ownership record-keeping platform for the digital assets agencies already manage on a client's behalf: domains, SSL/TLS certificates, hosting accounts, and plugin or software licenses — along with who owns each one and who's paying for it. That's genuinely relevant to the parts of an agentic storefront that touch those categories: the domain a WebMCP-enabled storefront runs on, the SSL certificate in front of an MCP or ACP gateway, or the hosting account for a self-managed catalog feed. Logging those renewal dates and ownership records next to the rest of a client's digital footprint means they don't get orphaned when a project changes hands between team members.
What InstaRenewal is not: a secrets vault, an identity and access management (IAM) platform, a live API or uptime monitor, or an automated compliance-scanning tool. It doesn't poll a client's /.well-known/mcp/server-card.json endpoint, doesn't verify OAuth token validity, doesn't store or rotate MCP bearer tokens, ACP merchant credentials, or AP2 signing keys, and doesn't watch checkout-session success rates. For the parts of this stack that actually need active monitoring — token health, endpoint uptime, spend-cap enforcement — agencies still need a dedicated secrets manager (1Password, Bitwarden, or similar) plus an observability tool built for API and agent traffic.
InstaRenewal's role here is the same narrow, complementary one it plays anywhere else in an agency's stack: keep the ownership and renewal record straight for the infrastructure sitting around the protocol layer, so that piece doesn't become the thing nobody remembers to check.
- Checklist: Onboarding a Client Into Agentic Commerce [ ] Determine which of MCP, WebMCP, ACP, AP2, and UCP the client's storefront actually needs — don't build for all five by default. [ ] Confirm merchant-of-record status and payment-provider setup for whichever checkout protocol (ACP, UCP, or both) applies. [ ] Configure OAuth 2.1 with PKCE on any MCP server exposed over HTTP; confirm Protected Resource Metadata is published. [ ] Store MCP bearer tokens, ACP API credentials, and any AP2-related signing material in a dedicated secrets manager — not a shared doc, and not a renewal tracker. [ ] Set up fallback/retry behavior in the application layer for 401/429 responses from any protocol endpoint. [ ] Publish a discovery manifest for MCP servers where relevant, and note that the discovery path itself is still an evolving draft standard. [ ] Log the domains, SSL certificates, and hosting accounts behind every agent-facing endpoint in InstaRenewal, alongside the client's other digital assets. [ ] Set a fixed monthly (not just real-time-alert-based) audit of which client integrations are still live against which protocols. [ ] Test checkout and tool-call failover behavior under a simulated expired-credential scenario before go-live.
- Conclusion The "agentic web" isn't a single standard an agency integrates once and forgets — it's a fast-moving stack of five overlapping specifications, each with its own governance body, its own release cadence, and its own credential model, and at least two of them (ACP's Instant Checkout feature, WebMCP's browser support) have already changed shape materially within a year of launch. Agencies that treat every layer of that stack — MCP and WebMCP tool access, ACP and UCP checkout credentials, AP2 mandate signing — with the same operational discipline they'd apply to a production dependency will be the ones whose clients' stores stay open to agents as well as humans. A renewal-tracking platform like InstaRenewal has a real, narrower role in that picture: keeping the ownership and renewal record straight for the domains, certificates, and hosting accounts underneath the protocol layer, so that part of the stack doesn't become the next thing nobody remembers to check.
Sources
Anthropic — Donating the Model Context Protocol and establishing the Agentic AI Foundation
Linux Foundation — Newsletter, January 2026; AAIF announcement coverage
Model Context Protocol — official specification and 2025-03-26 authorization revision (RFC 9728, RFC 7591)
W3C Web Machine Learning Community Group — WebMCP Draft Community Group Report, February 10, 2026
IETF — draft-serra-mcp-discovery-uri (Internet-Draft, informational, not yet ratified)
Stripe — "Developing an open standard for agentic commerce" and Agentic Commerce Suite announcement
OpenAI — "Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol"
Agentic Commerce Protocol — GitHub specification repository and SEP governance docs
Google Cloud Blog — "Announcing Agent Payments Protocol (AP2)"
AP2 Protocol — official specification, v0.2.0 release notes, FIDO Alliance governance transition
Shopify — "The agentic commerce platform: Shopify connects any merchant to every AI conversation"
Google — Universal Commerce Protocol announcement, NRF 2026
GitGuardian — The State of Secrets Sprawl 2026
Note on sourcing: protocol names, governance details, and adoption numbers in this space are changing quickly — verify current status against each protocol's official specification before publishing or acting on specific figures.
Top comments (0)