How can a Token-tier UCP client obtain permission to call complete_checkout?

Agentic Commerce
1

Hi Shopify team,

We’re building Gratos, a buyer-authorized gifting platform, and have implemented Shopify’s agentic commerce flow across Catalog MCP, Cart MCP, and Checkout MCP.

We currently have:

  • Shopify Global API credentials
  • Token-tier authentication
  • A publicly hosted UCP agent profile
  • Working catalog search and cart creation
  • Working create_checkout and update_checkout calls
  • Checkout sessions that reach a state where they appear ready for completion

However, when attempting API-side checkout completion, we receive:

checkout_completion_ineligible
This checkout is ineligible for completion via API.

The documentation says that the API token must be granted permission to complete purchases, but we have not found a public application process or documentation describing how that permission is obtained.

Could someone clarify:

  1. How does a Token-tier platform apply for access to complete_checkout?
  2. Is the permission applied to the Global API client, the merchant, the payment handler, or a specific checkout?
  3. Is there a sandbox or test merchant where approved platforms can validate end-to-end completion?
  4. Does direct checkout completion currently require Shop Pay delegated payments?
  5. Can approved third-party network-token providers be used with the dev.shopify.card handler?
  6. Is there a separate process for obtaining Order MCP access and order webhooks?

Our initial use case is buyer-present and deterministic:

  • The buyer reviews the merchant, exact products, recipient, shipping method, and final total.
  • The buyer explicitly confirms the purchase.
  • Payment authorization is restricted to the approved checkout and amount.
  • The original Shopify merchant remains the merchant of record.
  • We do not store raw card numbers.
  • We support continue_url escalation when buyer interaction or 3DS is required.

We can provide our Partner organization ID, Global API client ID, agent profile URL, test-store details, request logs, and architecture privately.

Any guidance on the correct approval or integration-review path would be appreciated.

Thanks and Best,

Gratos Team