We Built OAuth Identity Linking Into Our AI Agent Commerce Playground — Here's How the Protocol Actually Works

In our last post, we ran 180 AI agent shopping sessions across 11 models and 20 live stores. Every single session was anonymous. The agent connected, searched the catalog, built a cart, reached checkout — and the merchant had no idea who the buyer was. That's fine for product discovery. It's a dead end for real commerce. Without identity, there's no loyalty pricing. No saved addresses. No order history. No way to say "ship it to the same place as last time." The agent collects buyer info from scratch every session — name, email, phone, shipping address — adding 4-5 messages before checkout can even start. In our 180-session dataset, that friction was consistent across every model and every store. So we built identity linking into UCP Playground. What changed in the spec On March 18, a breaking change landed in the UCP repository: feat!: redesign identity linking with mechanism registry and capability-driven scopes. Identity linking — dev.ucp.common.identity_linking — is now one of four