An AI agent searched a 40,000-SKU store, identified a product, pre-populated the buyer's details from a linked identity, debited a wallet, and created a paid WooCommerce order — with zero human interaction after the initial consent screen.
This is what I built this week. Here's how it works.
The Problem: AI Agents Can't Authenticate as Customers
AI agents can already browse your store, read product listings, and build a cart. That part is solved by protocols like UCP (Universal Commerce Protocol) and MCP (Model Context Protocol).
But the moment an agent tries to actually complete a purchase, it hits a wall:
- Whose account is this order going on?
- What's the shipping address?
- How does the agent pay without a browser redirect?
The standard answer is: surface a continue_url and make the human finish the job in a browser. That's not agentic commerce — that's just a fancy product search with extra steps.
The real problem is identity. The agent doesn't know who it's acting for, and the store doesn't know who the agent represents.
The Solution: OAuth 2.0 Identity Linking
The draft UCP spec (version 2026-03-14) introduces a capability called dev.ucp.common.identity_linking. The mechanism is OAuth 2.0 Authorization Code flow with PKCE, where the AI agent platform is the OAuth client and the WooCommerce store is the authorization server.
The flow in plain English:
- Agent platform discovers the store's capabilities via
/.well-known/ucp - Sees that the store supports identity linking via OAuth 2.0
- Discovers the OAuth server metadata endpoint (RFC 8414)
- Initiates an authorization request — the customer sees a consent screen
- Customer approves once — agent platform receives a bearer token
- Every subsequent API call includes that token
- The store resolves the token to a WC customer account and pre-populates all buyer data automatically
After consent, every checkout session created with that bearer token automatically has the customer's name, email, billing address, shipping address, and available store credit surfaced as a payment instrument — without the customer doing anything.
The customer approves once. After that, the agent can complete purchases autonomously until the token expires or the customer revokes access.
What I Built: UCPReady
UCPReady is a WooCommerce plugin that implements the full UCP spec including identity linking. The key components:
A complete OAuth 2.0 authorization server inside WordPress — dynamic client registration, Authorization Code + PKCE S256, refresh token rotation, token revocation with cascade revocation on account events, and RFC 8414 server metadata. All rendered server-side, no external dependencies.
Identity resolution — bearer token resolves to a WC customer automatically. Checkout sessions created with a valid token have buyer data pre-populated without any additional calls.
Connected Agents tab in My Account — customers see every agent platform that has access, when it was granted, when it expires, and can revoke any of them with one click.
Automatic token revocation — tokens are cascade-revoked automatically when a customer changes their password, updates their account, or deletes their account. No stale access.