generated: '2026-08-05'
method: probed
source:
- https://100thieves.com/.well-known/openid-configuration
- https://100thieves.com/.well-known/oauth-authorization-server
- https://100thieves.com/api/ucp/mcp
- https://100thieves.com/api/2024-04/graphql.json
docs: https://100thieves.com/agents.md
note: >-
  Derived from live probes, not from an OpenAPI document — 100 Thieves publishes no
  spec. derive-authentication.py found 0 schemes because there is no openapi/ directory;
  this file records the auth model actually observed on the wire.
summary:
  types: [none, oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
  anonymous_surfaces: 3
schemes:
- name: anonymous-ucp-mcp
  type: none
  applies_to: https://100thieves.com/api/ucp/mcp
  observed: tools/list returned HTTP 200 with the full tool set and input schemas without
    any credential.
  note: Transacting tools still enforce a buyer-approval invariant at payment; that
    is a policy control, not an authentication control.
- name: anonymous-storefront-graphql
  type: none
  applies_to: https://100thieves.com/api/2024-04/graphql.json
  observed: Full introspection returned HTTP 200 (414 types) with no X-Shopify-Storefront-Access-Token
    header.
  note: Customer-scoped fields still require a customerAccessToken obtained via the
    customerAccessTokenCreate mutation.
- name: anonymous-storefront-json
  type: none
  applies_to: https://100thieves.com/
  observed: /collections/all/products.json returned HTTP 200 unauthenticated.
- name: shopify-customer-accounts-oidc
  type: openIdConnect
  openIdConnectUrl: https://100thieves.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/31052262
  authorizationUrl: https://shopify.com/authentication/31052262/oauth/authorize
  tokenUrl: https://shopify.com/authentication/31052262/oauth/token
  end_session_endpoint: https://shopify.com/authentication/31052262/logout
  jwks_uri: https://shopify.com/authentication/31052262/.well-known/jwks.json
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic]
  pkce: [S256]
  id_token_signing_alg: [RS256]
  subject_types: [public]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  applies_to: Customer account sign-in at https://100thieves.com/account/login
  provider: Shopify Customer Accounts (shop id 31052262)
- name: shopify-customer-account-oauth2
  type: oauth2
  source: https://100thieves.com/.well-known/oauth-authorization-server
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/31052262/oauth/authorize
    tokenUrl: https://shopify.com/authentication/31052262/oauth/token
    scopes: 4
  note: The RFC 8414 metadata document is byte-identical to the OIDC discovery document.
- name: customer-access-token
  type: apiKey
  in: header
  parameter: X-Shopify-Customer-Access-Token
  applies_to: https://100thieves.com/api/2024-04/graphql.json
  observed: Required by the customer query field per the introspected schema; obtained
    via customerAccessTokenCreate.
  note: Documented by the platform vendor, not by 100 Thieves.
x-evidence:
- url: https://100thieves.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json
- url: https://100thieves.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
- url: https://100thieves.com/api/ucp/mcp
  http_status: 200
  note: anonymous tools/list
- url: https://100thieves.com/api/2024-04/graphql.json
  http_status: 200
  note: anonymous full introspection