UcpCredentialsService

Service for managing the outbound credentials that Google uses to call a business's Universal Commerce Protocol (UCP) endpoints.

Currently, only standalone accounts and sub-accounts are supported. Requests for an advanced account fail with a PERMISSION_DENIED error and don't read or change any credentials.

While the account has an approved UCP checkout management link to a service provider, only that service provider can create, update or delete the credentials. Requests from other callers fail with a FAILED_PRECONDITION error (UCP_CREDENTIALS_MANAGED_BY_SERVICE_PROVIDER).

When a business uses Google account linking for UCP, the following authentication flow occurs:

  1. The shopper links their account with the business to their Google Account.
  2. Google obtains an OAuth access token for the shopper's account with the business.
  3. Google calls the business's UCP endpoints using this access token, rather than stored credentials.

For businesses that use Google account linking:

  • You can't set or change client_credentials or basic_auth. Requests that try fail with a FAILED_PRECONDITION error (UCP_CREDENTIALS_MANAGED_BY_ACCOUNT_LINKING).
  • You can still set an api_key, which Google sends together with the access token.