What is /.well-known/ucp?

It is the public business-profile path used by Universal Commerce Protocol. The profile declares the UCP version, services, optional capabilities and payment handlers a platform or shopping agent can negotiate with the business.

Does a UCP profile need authentication?

No. Google's current UCP merchant guidance says the business profile at /.well-known/ucp must be publicly accessible and must not require authentication.

Can /.well-known/ucp redirect?

Current UCP profile requirements say profiles must be served over HTTPS and profile endpoints must not use HTTP redirects. Check the versioned specification before deployment because protocol requirements can change.

Does zFinia upload the profile I paste into this validator?

No. This validator parses the pasted JSON in the browser. It does not fetch a domain or send the pasted profile to a zFinia server.

Editorial

Developer tool · UCP

Check a UCP business profile before an agent has to discover the mistake.

Paste the JSON you plan to publish at /.well-known/ucp. This privacy-first validator checks the core profile shape in your browser: the required ucp object, protocol version, services registry, capabilities, payment handlers and public-key surface. It does not crawl your store or upload the document.

Published 12 September 2026 · validator rules are intentionally narrower than the full versioned UCP schemas

Paste your /.well-known/ucp JSON

Privacy boundary: validation happens in your browser. zFinia does not fetch a domain, submit this JSON, or send the pasted profile to a server.

Validation result

Structure first, hosting checks second

Paste a profile to check the JSON shape, required UCP registries, declared version, services, capabilities, payment handlers and public-key surface.

Hosting checks this browser-only validator cannot prove

• Serve the business profile publicly at /.well-known/ucp with no authentication.
• Serve it over HTTPS and verify the profile endpoint does not redirect.
• Return cache headers compatible with the UCP profile requirements, including public caching and the required minimum max-age.
• Validate service-specific descriptors, schemas, extensions and payment handlers against the exact version your profile declares.

What the official profile does

Discovery is a contract, not a keyword file

Google's current UCP implementation guide describes the business profile as the public document used to negotiate capabilities with an agent. It declares the protocol version, services and payment handlers, and can describe capabilities and public keys used by the implementation.

The public UCP specification says businesses publish that profile at /.well-known/ucp. Platforms advertise their own profile URL separately, allowing both sides to compute the compatible capability set before consequential commerce calls begin.

Why zFinia made this browser-only

A validator does not need to become another crawler

Public UCP discovery is useful, but a paste-in structural check has a different job: help a merchant catch obvious contract errors before deployment without sending an unpublished profile anywhere. Network-level validation still matters after publication — status code, redirects, TLS, cache policy and the live service endpoints can only be proven against the deployed origin.

What is UCP?AI shopping discoverability UCP vs ACP context Machine-readable service discovery zFinia machine-service catalogue

Primary sources

This tool is a fast structural preflight, not a certification service and not a substitute for validating against the exact versioned schemas and live origin behavior required by UCP.