While no authentication is required, Google supports the following application and transport-layer security options when calling the business's Native Checkout API and Cart API endpoints.
Application-layer authentication
You can configure your UCP API endpoints to authenticate incoming HTTP requests from Google using API keys or OAuth 2.0 bearer tokens.
API keys
HTTP Header: X-API-Key
A shared secret value which will be used in Google's UCP API client request
HTTP header to authenticate with the checkout endpoint.
OAuth 2.0 (recommended)
HTTP Header: Authorization: Bearer <Access Token>
Following RFC 6749,
Google's UCP Platform agent uses the following properties to request the
access tokens needed for checkout endpoint interaction.
| Property | Description |
|---|---|
| Client ID | A unique string representing the client (for example, Google's UCP APIclient) |
| Client Secret | A password type string used to authenticate with the authorization server |
| Authorization endpoint URL | The URL to the OAuth2 API endpoint |
| Format | Basic authentication HTTP header or HTTP body |
| Encoding | Form data or JSON |
Mutual TLS (mTLS)
Google supports network-layer Mutual TLS (mTLS) for identity verification during the TCP/TLS handshake. Using mTLS allows your perimeter firewall, load balancer, or API gateway to verify and allowlist incoming Google UCP traffic without relying on dynamic IP ranges or geographic IP filtering.
During the TLS handshake, Google presents short-lived client certificates signed by Google's dedicated UCP Root Certificate Authorities (CAs). For additional details on Google's dual-layer security model, see the Partner Security & mTLS Integration Guide.
Trust anchors (Root CAs)
To prevent perimeter firewalls from dropping or geo-blocking incoming requests to your UCP endpoints, import Google's UCP Root Certificate Authorities into your load balancer, API gateway, or reverse proxy trust store.
Production root certificate
Use this root certificate for active production traffic from Google UCP services.
| Property | Value |
|---|---|
| Subject | CN=Google UCP Root CA, O=Google LLC |
| Valid Until | August 2, 2036 |
| Key Algorithm | RSA 2048-bit (SHA-256) |
| Direct Download | https://ucp.goog/certs/google_ucp_root_ca.crt |
| SHA-256 Fingerprint | 6E:B1:D7:72:57:86:32:42:8B:8C:FF:F3:4F:76:60:D6:3A:FA:62:E6:FC:F2:DA:F7:4D:CA:9A:A7:7D:F3:D0:93 |
Staging or sandbox root certificate
Use this root certificate for pre-production integration testing, sandbox environments, and UCP client verification tools.
| Property | Value |
|---|---|
| Subject | CN=Google UCP Root CA (stg), O=Google LLC |
| Valid Until | September 5, 2036 |
| Key Algorithm | RSA 2048-bit (SHA-256) |
| Direct Download | https://ucp.goog/certs/google_ucp_staging_root_ca.crt |
| SHA-256 Fingerprint | 1C:AA:92:A5:68:09:FD:35:9C:4E:5B:BB:F6:48:6E:E9:9F:2B:A7:90:0E:D2:4D:38:07:8A:42:B5:D8:E8:A7:43 |
Download and verify certificates
After downloading a Root CA certificate, verify that its SHA-256 fingerprint matches the published fingerprint before adding it to your trust store:
# Download the Root CA certificate
curl -sSL https://ucp.goog/certs/google_ucp_root_ca.crt -o google_ucp_root_ca.crt
# Verify that the local certificate SHA-256 fingerprint matches
openssl x509 -noout -fingerprint -sha256 -in google_ucp_root_ca.crt
Configure your gateway
Configure client certificate authentication on your perimeter load balancer or API gateway (for example, NGINX, Cloudflare Enterprise, AWS ALB, Kong, Envoy, or F5).
The following example demonstrates how to configure NGINX to verify incoming UCP requests using the Google UCP Root CA:
server {
listen 443 ssl;
server_name my-business.domain;
ssl_certificate /path/to/server.crt;
ssl_certificate_key /path/to/server.key;
# Trust Google UCP Root CA for mTLS
ssl_client_certificate /path/to/google_ucp_root_ca.crt;
ssl_verify_client on;
ssl_verify_depth 2;
location /ucp/ {
proxy_pass http://backend_ucp_service;
}
}