Do agentic checkout protocols require idempotency?

OpenAI's checkout rules and Google's now both demand an idempotency key, yet each judges a retry a different way. https://brandonlazovic.dev/articles/a... OpenAI brands its checkout spec Agentic Commerce Protocol, ACP for short, and it has required an idempotency key on every write since the April 17, 2026 release. That key is a one-off tag on each request, which lets a merchant recognize a repeat and hand back the original response rather than bill twice. Google brands its own checkout spec Universal Commerce Protocol, UCP for short, and its schema requires that same key across every write operation. ACP's checkout RFC calls two requests identical once their parsed bodies agree, no matter how the raw bytes are ordered, so reordering a request's fields still returns the cached answer. UCP's Message Signatures spec instead hashes the exact bytes sent, so the same reorder changes the hash and the retry comes back rejected as a conflict. ACP also covers a second attempt that arrives before the first has finished, asking the agent to pause and try again once that call resolves. UCP's specification gives no rule at all for that situation, so a merchant serving both protocols has to build each duplicate test separately and decide the in-flight case on its own server, then confirm it by sending a Complete Checkout call and its exact twin at the same moment, both under a single key. 0:00 Two checkout protocols read the same retried request, and they differ 0:48 Both protocols require the key on every write, in their schemas 1:17 ACP treats a retry with reordered fields as the same request 1:48 UCP rejects that same retry as a 409 conflict 2:21 ACP answers a retry that arrives mid-request with a 409 and a wait 2:49 UCP leaves the in-flight retry to the merchant's own server 3:18 A merchant serving both builds two duplicate tests and decides one case