# UCP Merchant Profile > Publish a signed UCP profile at /.well-known/ucp from Magento 2 with ECDSA P-256 keys, spec 2026-04-08. Free MIT-licensed module. Source: https://angeo.dev/modules/ucp/ Updated: 2026-10-17 05 - Transact - Open source # UCP Merchant Profile for Magento 2 angeo/module-ucp Publishes a Universal Commerce Protocol profile at `/.well-known/ucp` with ECDSA P-256 signing keys, so an AI agent can verify who the merchant is before acting on their behalf. UCPECDSA P-256/.well-knownMIT # install $ composer require angeo/module-ucp $ bin/magento setup:upgrade # generate the signing key pair $ bin/magento angeo:ucp:keys:generate # verify $ curl -s https://your-store.com/.well-known/ucp | jq . Free and MIT-licensed. No licence key, no account, no telemetry. ## What it does Four things worth knowing before you install. ### A signed, verifiable manifest The profile is served at the well-known path and signed with an ECDSA P-256 key pair, so an agent can confirm it came from you rather than trusting a URL. ### Key rotation without downtime Keys can be rotated with an overlap period, so agents holding the previous key are not cut off mid-transition. ### Validated against the spec Generated against UCP spec version 2026-08-25, with declared capabilities and correct cache headers, rather than being hand-assembled JSON that happens to parse. ### Multi-store scope One profile per store view where store views represent genuinely different merchants or markets. **This layer is early.** Agent-initiated commerce is not yet mainstream traffic. Publishing a profile costs an afternoon and positions you for it; treat it as preparation, not as a source of orders this quarter. ## Requirements | Magento | Open Source / Adobe Commerce 2.4.x | | PHP | 8.2+ | | Protocol | Universal Commerce Protocol | | Signing | ECDSA P-256 | | Licence | MIT | ## Questions ### Is UCP the same as ACP? No. ACP is how a catalogue reaches ChatGPT Shopping. UCP is how an agent verifies the merchant it is dealing with. They cover different steps and are complementary. ### Does publishing a profile expose anything sensitive? No. The manifest contains merchant identity and capability information plus a public key. Private keys never leave the server. ### Do agents actually use this today? Adoption is early. The honest position is that this prepares the store for agent-initiated commerce rather than delivering traffic now. ### How do I confirm it works? Request /.well-known/ucp and check that the manifest parses and the signature validates. The AEO audit also reports it as a signal. ## Works with Each module is independent, but these three are the ones most often installed alongside it. [angeo/module-openai-product-feed-api](https://angeo.dev/modules/openai-product-feed-api/) [angeo/module-robots-txt-aeo](https://angeo.dev/modules/robots-txt-aeo/) [angeo/module-aeo-audit](https://angeo.dev/modules/aeo-audit/) ## Not sure whether you need this one? Run the free scanner on your domain, or install the CLI audit. Both report which signals your store currently fails, so you install only what closes a real gap. [Scan my store](https://angeo.dev/ai-magento-audit/) [All modules](https://angeo.dev/modules/) ## More on this topic - [UCP (Universal Commerce Protocol) - Definition](https://angeo.dev/ucp-definition/) - [UCP Catalog Service for Magento 2](https://angeo.dev/modules/ucp-catalog/) - [/.well-known/ucp - The UCP Business Profile](https://angeo.dev/well-known-ucp-definition/) - [UCP Authority Binding - Definition and Algorithm](https://angeo.dev/ucp-authority-binding/) - [What Is UCP? Google's Commerce Protocol Explained](https://angeo.dev/what-is-ucp-for-store-owners/) - [UCP Readiness Checklist for Magento 2: 10 Steps (2026)](https://angeo.dev/ucp-readiness-checklist-magento/) - [Technical reference - every setting, command and default](https://angeo.dev/docs/modules/ucp/) - [UCP Checkout - module](https://angeo.dev/modules/ucp-checkout/) - [UCP for Magento 2 - complete guide](https://angeo.dev/magento-ucp/)