Skill

ucp-identity-linking

Implements UCP Identity Linking with OAuth 2.0 authorization code flow to connect buyer accounts across platforms and merchants for personalized checkouts.

Oauth

authentication

api-development

Install

npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin ucp-agentic-commerce

Tool Access

This skill is limited to using the following tools:

ReadWriteEditBashGrepGlobWebSearchWebFetch

Preview

**Fetch live spec**: Web-search `site:ucp.dev specification identity-linking` and fetch the page for exact OAuth requirements, scopes, and metadata format.

SKILL.md

Similar Skills

cache-components

Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.

cache-components

139.1k

claude-opus-4-5-migration

2 files

Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.

claude-opus-4-5-migration

83.2k

claude-code-plugin-release

1 file

Automates semantic versioning and release workflow for Claude Code plugins: bumps versions in package.json, marketplace.json, plugin.json; verifies builds; creates git tags, GitHub releases, changelogs.

claude-mem

64.7k

Stats

Parent Repo Stars14

Parent Repo Forks9

Last CommitMar 9, 2026

Actions

View Source View Plugin View on GitHub View README

UCP Identity Linking

Before writing code

Fetch live spec: Web-search site:ucp.dev specification identity-linking and fetch the page for exact OAuth requirements, scopes, and metadata format.

Also fetch https://developers.google.com/merchant/ucp/guides/identity-linking for Google's integration guide.

Conceptual Architecture

What It Enables

Identity Linking lets a Platform (AI agent) authenticate a buyer with a Business (merchant) so the agent can:

Access the buyer's existing account (loyalty points, saved addresses, order history)
Apply account-specific discounts or pricing
Provide personalized checkout experiences

Protocol: OAuth 2.0 Authorization Code Flow

UCP mandates RFC 6749 Section 4.1 (Authorization Code) as the primary mechanism:

Platform redirects buyer to Business's authorization endpoint
Buyer authenticates and consents
Business redirects back with authorization code
Platform exchanges code for access token at Business's token endpoint
Platform includes access token in subsequent UCP requests

Requirements

HTTP Basic Authentication (RFC 7617) for client credentials at the token endpoint
RFC 8414 OAuth Authorization Server Metadata at /.well-known/oauth-authorization-server
RFC 7009 token revocation support
RFC 9728 HTTP Resource Metadata — for discovering and linking identity provider metadata
Optional: OpenID RISC Profile 1.0 for async account status updates (e.g., account deleted)

UCP Scopes

Scope	Grants
`ucp:scopes:checkout_session`	All checkout operations (create, get, update, complete, cancel)

A scope covering a capability grants access to ALL operations of that capability.

Capability Declaration

Identity Linking is declared as a capability in the Business's discovery profile. It includes:

Authorization endpoint URL
Token endpoint URL
Supported scopes
Client registration details

Implementation Guidance

Business:

Implement standard OAuth 2.0 Authorization Code server
Publish OAuth metadata at /.well-known/oauth-authorization-server
Map UCP scopes to internal permissions
Issue access tokens that the Platform includes in UCP requests

Platform:

Discover identity linking capability from Business profile
Initiate OAuth flow when buyer wants to link their account
Store and refresh access tokens
Include tokens in UCP request authorization

Fetch the exact current requirements from the live spec — OAuth details (PKCE requirements, token formats, etc.) may evolve.