Does a Shopify store need to do anything for UCP?

Short answer: you probably already have a UCP profile, you did not create it, and there is one thing about it that is very likely wrong. Whether that is your problem to fix depends on which part.

Accurate as of July 2026, checked against live stores.

You may already be participating

Shopify is one of the co-developing companies behind UCP, and it publishes profiles on behalf of merchants. So unlike most standards, where adoption means doing work, here the default is that something is already being served from your domain.

When we ran our checker across a set of well known direct to consumer brands in July 2026, five were serving live profiles: Allbirds, Rothys, Skims, Brooklinen and Glossier. None of those merchants hand-wrote those files.

You can see yours right now:

curl -s https://yourstore.com/.well-known/ucp | head -40

What is in it

A Shopify-served profile declares the current version, the shopping service and its transports, a set of capabilities, and the payment handlers available. Trimmed down, it looks like this:

{
  "ucp": {
    "version": "2026-04-08",
    "services": {
      "dev.ucp.shopping": { "transports": ["mcp", "embedded"] }
    },
    "capabilities": {
      "dev.ucp.shopping.cart": {},
      "dev.ucp.shopping.checkout": {},
      "dev.ucp.shopping.fulfillment": {},
      "dev.ucp.shopping.discount": {},
      "dev.ucp.shopping.order": {},
      "dev.ucp.shopping.catalog.search": {},
      "dev.ucp.shopping.catalog.lookup": {},
      "dev.shopify.catalog": {}
    },
    "payment_handlers": {
      "com.google.pay": {},
      "dev.shopify.card": {},
      "dev.shopify.shop_pay": {}
    }
  }
}

Eight capabilities including cart, checkout, fulfilment, discounts, order lookup and catalogue search. The dev.shopify.catalog entry is a vendor extension, which the specification allows for.

This is a genuinely capable declaration. An agent reading it knows it can search your catalogue, build a basket, apply a discount and check out, before loading a page.

The one thing that is wrong

Every Shopify-served profile we checked was missing the Cache-Control header that the specification requires on the profile response.

curl -sI -H "Accept: application/json" https://yourstore.com/.well-known/ucp | grep -i cache-control
# returns nothing

The consequence is not catastrophic but it is not nothing: agents cannot cache your profile, so every discovery hits your origin fresh instead of being served from a local copy.

Two honest points about this. First, it is consistent across every store we tested, which means it is a platform behaviour rather than five merchants making the same mistake. Second, and following from that, it is almost certainly not yours to fix. You do not control the headers on a file Shopify serves for you.

So why care? Because it is the clearest illustration of the situation you are actually in: you have an integration you did not build, doing something you have not checked, whose defects you may not be able to fix directly. Knowing that is worth more than assuming it is handled.

If it matters to your traffic profile, it is a support conversation with Shopify rather than a code change.

What is genuinely yours to check

Some things are entirely within your control, and these are worth ten minutes.

Both hosts must answer

This is the one that actually breaks discovery, and it is yours.

The specification says agents must not follow redirects when fetching a profile, and they do not. If your apex redirects to www and the profile only resolves on one of them, then for any agent trying the other host, you have no integration at all.

Custom domains, domain migrations and marketing redirects all make this more likely than you would expect. Test both:

curl -sI -H "Accept: application/json" https://yourstore.com/.well-known/ucp | head -1
curl -sI -H "Accept: application/json" https://www.yourstore.com/.well-known/ucp | head -1

Both should return 200. If one returns 301 or 302, that is a real gap.

Worth knowing: behaviour can vary by request headers. When we tested Allbirds, the apex returned a redirect to a browser-style request but served the profile directly when asked with Accept: application/json. That is why testing with a browser is not a reliable check, and why our checker sends what an agent sends.

Your storefront still has to work

The profile says you support catalog.search and checkout. That is a promise about your store, not just about a JSON file.

If an agent takes you up on it and your checkout depends on a modal being dismissed, or your product pages render prices via script after load, the declaration is accurate and the experience still fails. The profile advertises capability; your storefront has to deliver it.

Bot rules apply to agents too

A profile an agent cannot reach is not a profile. If you have added aggressive bot protection, or your plan includes rules that challenge unfamiliar clients, check that the well-known path is reachable. A challenge page returned with a 200 is worse than a clean 404, because it looks like a response and parses as nothing.

Headless and custom domains

If you run a headless setup, or your storefront is on a domain that is not where Shopify serves the profile, verify explicitly. The profile has to be on the host your customers actually reach, because that is the host an agent will try.

This is the case most likely to be silently broken, because everything else about a headless build can be working perfectly.

A ten minute checklist

1. Fetch /.well-known/ucp on both apex and www. Both should be 200, neither a redirect.
2. Confirm the body parses as JSON and declares a version.
3. Check whether Cache-Control is present. If it is missing, note it; it is likely a platform matter.
4. Confirm the declared version is current. 2026-04-08 at the time of writing.
5. If you are headless or on a custom domain, verify the profile is on the customer-facing host.
6. Run a full check to catch the things this list does not cover, including whether anything private has been published by mistake.

So, do you need to do anything?

If you are on standard Shopify with a straightforward domain setup: probably not much. Verify both hosts answer, and know what your profile claims so you are not surprised by it.

If you are headless, recently migrated a domain, run multiple regional domains, or have custom edge rules: check properly. These are exactly the configurations where a profile ends up on a host nobody visits.

And in either case, the more useful long-term point is the one from the missing cache header. Your agent-facing integration is now partly managed by your platform. It will change when the platform changes it, and no one is going to tell you. That is an argument for checking on a schedule rather than once.

Read next

• What is UCP? — the standard itself, in plain English
• How to validate a UCP integration — the full checklist, platform independent
• Preparing your checkout for agentic commerce — making the storefront live up to the profile