AI agents and developers

Orchid Toys welcomes AI assistants and other software agents that shop on behalf of a real person. This page explains what an agent may do here, how to connect, how to identify itself, how buying works and where the limits are. It is written for the people who build agents and for the assistants that read it.

Our position in one paragraph

If you use an assistant to browse, compare or buy from Orchid Toys for yourself, that is fine with us. Agents may read every public page (products, collections, search, the blog and our policies), use the structured data on those pages, build a cart and hand you a Shopify checkout. They may not sign in as you without your say-so, touch anyone else's cart, checkout or account, or copy the catalog to sell elsewhere. Our Terms of Service apply to an agent exactly as they apply to the person it acts for.

How to connect

  • Agent guide: orchidtoys.com/agents.md, also served at /llms.txt and /llms-full.txt. Start there.
  • Universal Commerce Protocol (UCP) manifest: orchidtoys.com/.well-known/ucp. It lists this store's capabilities and the endpoints below.
  • MCP endpoint: https://orchidtoys.com/api/ucp/mcp (Model Context Protocol, JSON-RPC over HTTPS). Its tools include search_catalog, lookup_catalog, get_product, create_cart, update_cart, create_checkout, update_checkout, complete_checkout and get_order. Shopify runs it; the schemas are published at ucp.dev and in Shopify's developer documentation at shopify.dev.
  • Read-only product data: /products.json (the catalog, paged), /products/{handle}.json and /products/{handle}.js (one product with its variants, prices and availability), and /collections/{handle}/products.json.
  • Structured data: every product page carries Product or ProductGroup JSON-LD with offers, shipping and return facts; collection pages carry an ItemList; the home page carries a Best Sellers list and FAQ markup.
  • Sitemap and robots: /sitemap.xml and /robots.txt, which names the AI crawlers and user agents we allow.
  • Browser tools: in a browser that supports WebMCP, Shopify registers storefront tools (search, product, cart and checkout) on every page of this store. They act only in your own tab.

Identifying your agent

  • Send an honest User-Agent and follow robots.txt.
  • Sign your requests with Web Bot Auth. Shopify, which hosts this store, applies stricter rate limits to automated traffic that is not signed.
  • For the UCP and MCP endpoints, host an agent profile and send it as meta.ucp-agent.profile. Calls that send an agent profile but no buyer sign-in can search the catalog and build a cart; calls without a profile are refused.
  • To complete a checkout, register your agent in Shopify's Dev Dashboard and use the scoped grants Shopify issues (dev.ucp.shopping.catalog.search:read and dev.ucp.shopping.checkout:manage). Shopify publishes the authorization server details at /.well-known/oauth-authorization-server and requires PKCE. We do not run a separate developer program, sandbox or API key scheme of our own.

How buying works

  • An agent can search, compare, read prices and stock, and build a cart without signing in.
  • Checkout happens on Shopify's checkout, either on orchidtoys.com or inside an assistant that offers Shopify checkout. The person buying confirms the order before an agent can complete it, and agents never collect payment details outside Shopify's checkout.
  • Orchid Toys sells through Shopify Agentic storefronts. Which products an assistant can show or sell is decided by Shopify and by each assistant, not by this page, and many adult products are not eligible for in-assistant checkout. When direct checkout is not offered, send the shopper to the product page on orchidtoys.com.
  • Prices, discounts, stock and shipping change. Treat the live page or the API response as the source of truth, not a cached copy.

Signing in and consent

  • Customer accounts use an email address and a one-time code. There is no password to hand to an assistant, and an agent cannot sign in unless the account holder enters the code.
  • Authorizing an assistant through Shopify's sign-in, where you approve its access and can withdraw it, is not sharing your credentials. Access granted through Shop is managed in the Shop app's account settings.
  • Guest checkout works without an account.

What is not allowed

  • Reading or acting on another customer's cart, checkout, order or account.
  • Ignoring robots.txt, canonical tags or noindex rules, or requesting pages faster than a person would.
  • Copying product text, images or the catalog to resell or republish.
  • Presenting this store or its products to anyone under 18, or inventing medical, safety, compatibility or delivery claims that are not on the page.

Age-restricted store

Orchid Toys sells adult products. Shoppers must be 18 or older, or the legal age where they live. We do not vouch for any assistant's age checks, and an assistant should not describe this store as suitable for minors.

What Shopify decides

Some things agent platforms ask for are not ours to change on a Shopify-hosted store: passkeys on the sign-in page, high-assurance OAuth features (PAR, DPoP and RAR), dynamic client registration, files under /.well-known/ other than ucp and the OAuth metadata, and a connected-apps screen inside customer accounts. If you need one of those, the request goes to Shopify.

Questions

Use the contact page. We reply within one business day.