Comprehensive technical guidelines for partners and merchants integrating with Google’s Universal Commerce Protocol (UCP), covering Network-Layer Mutual TLS (mTLS) trust anchors and Application-Layer digital signatures.
Google UCP implements a defense-in-depth model for service communication between Google and partner endpoints:
| Security Layer | Protocol | Purpose | Validation Mechanism |
|---|---|---|---|
| Layer 3 / 4 (Network) | Mutual TLS (mTLS) | Identity verification during TCP/TLS handshake; perimeter firewall allow-listing without relying on dynamic Google IP ranges. | Merchant gateway trusts Google UCP Root CA; Google presents short-lived client certificates. |
| Layer 7 (Signatures) | HTTP Signatures (ES256 / HMAC) | Authenticity and anti-tampering of webhook and transaction payloads. | Partners verify signatures using public JSON Web Keys (JWK) published in ucp.json. |
| Layer 7 (Data Encryption) | HPKE (RFC 9180 X25519) | End-to-end confidentiality of partner authorization secrets (OAuth client secrets, tokens). | Partners encrypt payloads with Google's public key from ucp.json; see Data Encryption Guide. |
To prevent perimeter firewalls from dropping or geo-blocking incoming requests to your /ucp/* endpoints, import Google’s **UCP Root Certificate Authorities** into your Load Balancer, API Gateway, or Reverse Proxy trust store.
Use for active production traffic from Google UCP services.
| Subject | CN=Google UCP Root CA, O=Google LLC |
| Valid Until | July 24, 2036 |
| Key Algorithm | RSA 2048-bit (SHA-256) |
| Direct Download | https://ucp.goog/certs/google_ucp_root_ca.crt |
SHA-256 Fingerprint (Out-of-Band Verification):
Use for pre-production integration testing, sandbox environments, and UCP client verification tools.
| Subject | CN=Google UCP Root CA (stg), O=Google LLC |
| Valid Until | September 5, 2036 |
| Key Algorithm | RSA 2048-bit (SHA-256) |
| Direct Download | https://ucp.goog/certs/google_ucp_staging_root_ca.crt |
SHA-256 Fingerprint (Out-of-Band Verification):
# Verify local certificate SHA-256 fingerprint matching openssl x509 -noout -fingerprint -sha256 -in google_ucp_root_ca.crt # Download directly via CLI curl -sSL https://ucp.goog/certs/google_ucp_root_ca.crt -o google_ucp_root_ca.crt
verify or optional during initial staging verification.
# NGINX Configuration Snippet
server {
listen 443 ssl;
server_name my-business.domain;
ssl_certificate /path/to/server.crt;
ssl_certificate_key /path/to/server.key;
# Trust Google UCP Root CA for mTLS
ssl_client_certificate /path/to/google_ucp_root_ca.crt;
ssl_verify_client on;
ssl_verify_depth 2;
location /ucp/ {
proxy_pass http://backend_ucp_service;
}
}
In addition to TLS transport-layer security, requests contain digital signatures to verify payload origin and integrity.
Google signs outgoing UCP requests using Elliptic Curve (ECDSA P-256 / SHA-256) keys. Public verification keys are published as standard JSON Web Key Sets (JWKS) in the discovery profile:
Discovery Endpoint: https://ucp.goog/profiles/ucp.json (or /.well-known/ucp.json)
# Example discovery JWKS snippet inside ucp.json
"signing_keys": [
{
"kty": "EC",
"use": "sig",
"alg": "ES256",
"kid": "WxeU6A",
"crv": "P-256",
"x": "Z2cMSW6y_BVN5aBXMZhPuI2h0_edoevVlPL9ogys8BM",
"y": "2_v_di_Lpl2OBIsVFUBX9y87fSTIXhsA4pukpinUqWk"
}
]
For partner webhooks supporting shared secrets, signatures are passed in the HTTP header:
UCP-Signature: t=1784913000,v1=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Compute HMAC-SHA256 over timestamp + "." + raw_body using the encrypted secret exchanged during merchant onboarding.