Agentic Commerce for WooCommerce

Run ChatGPT Ads

• Campaigns inside WooCommerce → — create, budget, activate and pause campaigns; results sit next to the orders they produced, our reconciled count beside OpenAI’s.
• A ChatGPT product feed to OpenAI’s specification, with a per-product health score.
• Eligibility, up front — minimum catalog size and supported countries checked before you invest time.
• Conversion tracking — link your ads account and purchases from ChatGPT ads are reported back: funnel events from shoppers’ browsers plus a copy of each paid order from your server, under one id so nothing counts twice. Off until you link a pixel; marketing consent respected; your ads key is never stored on your site.
• Works with your existing pixels — Pixel Manager, PixelYourSite or GTM keep running; if another OpenAI pixel is on the store, ours records but does not forward.

Works alongside what you already run

If another plugin already does a job, this one stands down: Yoast SEO, Rank Math and SEOPress schema (fills only the gaps); AdTribes, CTX Feed and Google Listings & Ads feeds; Pixel Manager, PixelYourSite, GTM and WooCommerce Order Attribution; WP Rocket, LiteSpeed, Autoptimize and SiteGround Optimizer (excluded from JS optimization automatically). Declares HPOS and Cart/Checkout Blocks compatibility.

What it doesn’t do

• It doesn’t touch your checkout. Stripe / WooPayments / PayPal / Square / whatever you already use — payment runs through them, unchanged. Your payout schedule is unchanged.
• It doesn’t see your customers. Order summaries carry no buyer name, email, address or payment card. The one exception is ChatGPT Ads conversion tracking, which you switch on yourself: with the shopper’s marketing consent it sends their email (hashed before OpenAI sees it), IP address and user agent so the ad platform can match the purchase. See External services.
• It doesn’t require a new account or contract to start. Free to install and get going — paid plans available as you grow. See pricing .
• It doesn’t slow down your site. The JSON-LD block is tiny and cached; the catalog feed is served from xpay’s CDN, not your origin.

Getting started

Install, activate, click Connect store and grant a read-only WooCommerce REST API key on app.xpay.sh. Your catalog is live on AI surfaces within about 10 minutes. Requires WooCommerce 7.0+, WordPress 6.2+ and PHP 7.4+. Stuck? merchants@xpay.sh or the support forum. What the plugin sends and when: see Privacy and External services below, and the full disclosure .

Source code

GPLv2-or-later, readable PHP, all of it on your server once installed. Changelog: install.xpay.sh/woocommerce/CHANGELOG.md .

External services

This plugin connects to the following xpay-operated services to deliver its core function. Every endpoint and its purpose is documented; full payload disclosure is in the Privacy section.

1. 01agent-feed.xpay.sh — Public CDN that hosts your AI-readable catalog feed at https://agent-feed.xpay.sh/catalog/{your-slug}.json . The plugin does not contact this URL directly; the xpay backend writes it from your WooCommerce REST API after you click Connect store .
2. 02agent-commerce.xpay.sh — The agent-side API that AI shopping agents call to surface and buy from your products. The plugin contacts this host at the following paths: (a) POST /v1/onboard/woocommerce/wc-auth-callback is the WooCommerce OAuth callback target (WordPress itself calls this on your behalf, server-to-server, after you approve the one-click connect prompt); (b) GET /v1/onboard/woocommerce/status?nonce=… is polled by the xpay onboarding page while the handshake finishes; (c) POST /v1/merchants/{slug}/resync triggers a fresh catalog ingest after a product or stock change; (d) GET /v1/merchants/{slug} is called when xpay✦ Commerce → Settings verifies the current connection state; (e) PATCH /v1/merchants/{slug}/products/{sku} pushes a single-product delta when a WooCommerce product/stock webhook fires; (f) DELETE /v1/merchants/{slug} is sent (non-blocking) when you click Disconnect so xpay marks your account as disconnected and archives the cached catalog. The hostname is also the publicly advertised target for POST /mcp/{slug} (the JSON-RPC commerce MCP endpoint AI agents talk to) — the plugin itself does not call this URL but lists it in the /.well-known/ucp manifest.
3. 03app.xpay.sh/onboard/woocommerce — The merchant-side onboarding page. When you click Connect store , the plugin redirects your browser here with three query-string parameters: your site URL, your administrator email address, and a one-time random nonce generated locally. No data is sent to xpay before you click the button. You sign in or sign up on xpay and grant the WooCommerce REST API permission there.
4. 04agent-commerce.xpay.sh/v1/events — Optional anonymous lifecycle telemetry. Disabled by default; only contacted if you explicitly opt in via the first-activation admin notice or xpay✦ Commerce → Settings → Privacy . Full payload disclosure in the Privacy section.
5. 05agent-commerce.xpay.sh/v1/merchants/{slug}/orders — Agent-attributed order reporting for connected stores (non-PII order summary + attribution source; no customer, payment, or personal data). Off via the xpay_wc_order_events_enabled option. Full payload disclosure in the Privacy section.
6. 06agent-commerce.xpay.sh/v1/agent-analytics — Optional anonymous AI-bot crawl analytics. Disabled by default; shares the same opt-in as item 4 (and respects a separate define( 'XPAY_WC_AGENT_ANALYTICS', false ) hard-off). When enabled, the plugin counts requests from known AI bots only (e.g. GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended) — recording the bot name, a coarse page type (home/product/category/discovery-file/sitemap/other), the HTTP status, and whether we routed the bot to your structured catalog. It also sends an aggregate daily count of human pageviews (a number only — no user-agent, no URLs, no per-visit data) as the AI-vs-human denominator. Since 0.5.3 a bot event also carries a salted, one-way hash of the connecting IP address (a bot’s — behind a proxy or CDN this is the connecting edge address), so two hits from the same crawler can be counted as one visitor. The salt is unique to your store and is regenerated every day, so the hash cannot be linked across days or across stores, and the address itself is never stored or transmitted. This applies to AI bots only — a human visitor’s IP is never read, hashed or sent. Events are buffered locally and sent in the background by WP-Cron, never on a page load. Cart, checkout, account, admin and REST paths are never recorded. No per-visit human data, no customer, order, or personal data.
7. 07ai-readiness.xpay.sh — Merchant-facing audit dashboard. The plugin emits a link to ai-readiness.xpay.sh/m/{your-slug} on the Settings page so you can review the live agent-readiness score xpay computed from your catalog; the plugin itself does not fetch from this host. Opening the link from your browser sends standard browser headers to xpay.
8. 08auth.xpay.sh — Public OAuth-protected-resource discovery target. The plugin publishes auth.xpay.sh as the authorization_servers[0] entry in /.well-known/oauth-protected-resource (an RFC 9728 metadata document AI agents fetch to learn where to obtain a token). The plugin does not contact this host server-to-server; it is referenced for agent-side discovery only.
9. 09install.xpay.sh/woocommerce/{terms,privacy}.html — Legal pages linked from this readme and the Settings privacy panel; opened in your browser, never fetched by the plugin.
10. 10pixelproof.xpay.sh — xpay’s ChatGPT Ads conversion relay, contacted only when ChatGPT Ads conversion tracking is on (a pixel is linked on xpay✦ Commerce → ChatGPT Ads , or you chose “Always on”). Shoppers’ browsers send POST /pixel/events for page views, product views, add-to-cart, checkout start and purchase: t