A UPC is the number under the barcode on a release. Distributors hand one out with every release, and every shop, streaming service and database files that release under it. It identifies the release, not the recording: the track inside it has an ISRC.
The shapes it comes in
Twelve digits is the American UPC, thirteen is the European EAN, and fourteen turns up in wholesale catalogues. They are the same number with different amounts of padding, which is why the same release reads as 0075678 and 075678 depending on who printed it. The last digit is a check digit, so a mistyped barcode can be caught before it goes anywhere.
Why it is the only key that works
Titles differ by punctuation, artist names differ by spelling, and release dates differ by territory. The barcode is the one string every platform agrees on, which makes it the way to find the same release on a service that has never heard of the artist.
Where it goes wrong
A barcode typed from the wrong line of a distributor statement finds a different album. Anything acting on that number then puts the wrong album in front of a listener, which is why a barcode is worth nothing until something agrees it names this release.