While no authentication is required, Google supports the following application
and transport-layer security options when calling the business's Native Checkout
API and Cart API endpoints.

## Application-layer authentication

You can configure your UCP API endpoints to authenticate incoming HTTP requests
from Google using API keys or OAuth 2.0 bearer tokens.

### API keys

HTTP Header: `X-API-Key`

A shared secret value which will be used in Google's UCP API client request
HTTP header to authenticate with the `checkout` endpoint.

### OAuth 2.0 (recommended)

HTTP Header: `Authorization: Bearer <Access Token>`

Following [RFC 6749](https://tools.ietf.org/html/rfc6749),
Google's UCP Platform agent uses the following properties to request the
access tokens needed for `checkout` endpoint interaction.

| Property | Description |
|---|---|
| Client ID | A unique string representing the client (for example, Google's UCP APIclient) |
| Client Secret | A password type string used to authenticate with the authorization server |
| Authorization endpoint URL | The URL to the OAuth2 API endpoint |
| Format | Basic authentication HTTP header *or* HTTP body |
| Encoding | Form data *or* JSON |

## Mutual TLS (mTLS)

Google supports network-layer Mutual TLS (mTLS) for identity verification during
the TCP/TLS handshake. Using mTLS allows your perimeter firewall, load balancer,
or API gateway to verify and allowlist incoming Google UCP traffic without
relying on dynamic IP ranges or geographic IP filtering.

During the TLS handshake, Google presents short-lived client certificates signed
by Google's dedicated UCP Root Certificate Authorities (CAs). For additional
details on Google's dual-layer security model, see the [Partner Security \& mTLS
Integration Guide](https://ucp.goog/mtls.html).

### Trust anchors (Root CAs)

To prevent perimeter firewalls from dropping or geo-blocking incoming requests
to your UCP endpoints, import Google's UCP Root Certificate Authorities into
your load balancer, API gateway, or reverse proxy trust store.

#### Production root certificate

Use this root certificate for active production traffic from Google UCP
services.

| Property | Value |
|---|---|
| **Subject** | `CN=Google UCP Root CA, O=Google LLC` |
| **Valid Until** | August 2, 2036 |
| **Key Algorithm** | RSA 2048-bit (SHA-256) |
| **Direct Download** | <https://ucp.goog/certs/google_ucp_root_ca.crt> |
| **SHA-256 Fingerprint** | `6E:B1:D7:72:57:86:32:42:8B:8C:FF:F3:4F:76:60:D6:3A:FA:62:E6:FC:F2:DA:F7:4D:CA:9A:A7:7D:F3:D0:93` |

#### Staging or sandbox root certificate

Use this root certificate for pre-production integration testing, sandbox
environments, and UCP client verification tools.

| Property | Value |
|---|---|
| **Subject** | `CN=Google UCP Root CA (stg), O=Google LLC` |
| **Valid Until** | September 5, 2036 |
| **Key Algorithm** | RSA 2048-bit (SHA-256) |
| **Direct Download** | <https://ucp.goog/certs/google_ucp_staging_root_ca.crt> |
| **SHA-256 Fingerprint** | `1C:AA:92:A5:68:09:FD:35:9C:4E:5B:BB:F6:48:6E:E9:9F:2B:A7:90:0E:D2:4D:38:07:8A:42:B5:D8:E8:A7:43` |

### Download and verify certificates

After downloading a Root CA certificate, verify that its SHA-256 fingerprint
matches the published fingerprint before adding it to your trust store:

    # Download the Root CA certificate
    curl -sSL https://ucp.goog/certs/google_ucp_root_ca.crt -o google_ucp_root_ca.crt

    # Verify that the local certificate SHA-256 fingerprint matches
    openssl x509 -noout -fingerprint -sha256 -in google_ucp_root_ca.crt

### Configure your gateway

Configure client certificate authentication on your perimeter load balancer or
API gateway (for example, NGINX, Cloudflare Enterprise, AWS ALB, Kong, Envoy, or
F5).

> [!NOTE]
> **Note:** Set client authentication to `verify` or `optional` during initial staging verification to test connectivity before enforcing strict client certificate validation in production.

The following example demonstrates how to configure NGINX to verify incoming UCP
requests using the Google UCP Root CA:

    server {
        listen 443 ssl;
        server_name my-business.domain;

        ssl_certificate         /path/to/server.crt;
        ssl_certificate_key     /path/to/server.key;

        # Trust Google UCP Root CA for mTLS
        ssl_client_certificate  /path/to/google_ucp_root_ca.crt;
        ssl_verify_client       on;
        ssl_verify_depth        2;

        location /ucp/ {
            proxy_pass http://backend_ucp_service;
        }
    }