Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From ucp-agentic-commerce
Implements UCP AP2 Mandates for autonomous agent payments using SD-JWT credentials, JWS merchant signatures, and Agent Payments Protocol in 7-step flow with security lock.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin ucp-agentic-commerceHow this skill is triggered — by the user, by Claude, or both
Slash command
/ucp-agentic-commerce:ucp-ap2-mandatesThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
**Fetch live spec**:
Implements AP2 Payment Mandate VDC to signal AI involvement and user authorization in payments. Guides schema fetch, construction for merchant processors in auth flows, tokenization.
Implements UCP Checkout via A2A protocol for autonomous agent-to-agent commerce using Agent Cards and structured DataParts. For multi-agent architectures.
Creates p5.js generative art with seeded randomness, noise fields, and interactive parameter exploration. Use for algorithmic art, flow fields, or particle systems.
Share bugs, ideas, or general feedback.
Fetch live spec:
site:ucp.dev specification ap2-mandates for the extension schemasite:ap2-protocol.org for the AP2 protocol specificationAP2 (Agent Payments Protocol) enables fully autonomous agent commerce — the agent can authorize payments cryptographically without requiring real-time human approval for each transaction. The user pre-authorizes spending parameters, and the agent proves authorization via signed credentials.
Checkout Mandate (ap2.checkout_mandate): An SD-JWT+kb (Selective Disclosure JWT with Key Binding) credential that proves the user authorized the agent to complete this specific checkout at these specific terms.
Payment Mandate (payment_data.token): A separate credential proving payment authorization, verified by the PSP (not the Business).
Before the Platform generates mandates, the Business must sign the checkout terms:
<header>..<signature>The Business returns this merchant_authorization in the checkout response.
merchant_authorization (JWS detached content)complete_checkout callOnce AP2 is negotiated for a checkout session, a Security Lock is activated: neither party may revert to a standard (non-AP2) checkout flow for that session. This prevents downgrade attacks where a malicious actor could bypass the cryptographic mandate requirements by falling back to a simpler payment flow.
AP2-specific errors:
mandate_required — AP2 mandates needed but not providedagent_missing_key — Agent's signing key not foundmandate_invalid_signature — Signature verification failedmandate_expired — Mandate past validity windowmandate_scope_mismatch — Mandate doesn't match checkout termsmerchant_authorization_invalid — Business signature invalidmerchant_authorization_missing — Business didn't sign termsThis is the most complex UCP extension. Before implementing:
This extension is intended for advanced autonomous agent scenarios. Most initial implementations should start with standard payment handlers (Google Pay, Shop Pay) before adding AP2.