Configure Your UCP Resource Server

Agent platforms such as Gemini build their consent screen from the scopes your authorization server advertises. To make your UCP scopes discoverable, configure your API as the UCP resource server. Auth0 then publishes its scopes in your tenant’s discovery metadata.

Prerequisites

An API that represents your UCP server.
Resource Parameter Compatibility Profile (Optional): For MCP clients, we recommend enabling this profile in your tenant settings. This allows the authorization server to handle resource-specific requests (RFC 8707) by checking the resource parameter if the audience is not provided.

Configure the UCP resource server

You can only configure one API per tenant as the UCP resource server.

Auth0 Dashboard
Management API

Navigate to Dashboard > Applications > APIs and select your API.
On the Settings tab, find the Universal Commerce Protocol section.
Enable UCP Resource Server.
Select Save.

If another API in your tenant already has this setting enabled, saving the setting results in an error that names the conflicting API.Once you’ve configured UCP for the API, add your UCP scopes:

Select the Permissions tab.
Add each scope your UCP server supports. UCP scopes begin with dev.ucp, for example, dev.ucp.shopping.order:read, dev.ucp.shopping.cart:manage, and dev.ucp.shopping.checkout:manage. Enter a description for each scope.

Make sure your Management API access token has the create:resource_servers or update:resource_servers permission.To create a new UCP resource server, make a POST request to /api/v2/resource-servers:

curl --request POST \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/resource-servers' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_MGMT_API_TOKEN' \
  --data '{
    "name": "Acme UCP Server",
    "identifier": "https://ucp.acme.example.com",
    "type": "universal_commerce_protocol_server",
    "scopes": [
      { "value": "dev.ucp.shopping.order:read", "description": "Read orders" },
      { "value": "dev.ucp.shopping.cart:manage", "description": "Manage carts" },
      { "value": "dev.ucp.shopping.checkout:manage", "description": "Manage checkout" }
    ]
  }'

To configure an existing API as the UCP server, make a PATCH request to /api/v2/resource-servers/{id} with "type": "universal_commerce_protocol_server". Set the type before you add dev.ucp.* scopes or in the same request. Requests that add those UCP scopes to a standard API are rejected.

Set a default audience

Agent platforms such as Gemini send the scope parameter but not an audience parameter. Without an audience, Auth0 can’t tell which API to issue a token for. During Early Access, Auth0 resolves this from your tenant’s default audience. Set your UCP resource server’s identifier as the tenant default audience:

Navigate to Dashboard > Settings > General.
Under API Authorization Settings, set Default Audience to your UCP resource server’s identifier.
Select Save.

A per-application default audience is planned in a future release.

Next steps

Set up standard account linking

Get Started

Reference

Configure Your UCP Resource Server

Prerequisites

Configure the UCP resource server

Set a default audience

Next steps

​Prerequisites

​Configure the UCP resource server

​Set a default audience

​Next steps

Prerequisites

Configure the UCP resource server

Set a default audience

Next steps