generated: '2026-09-07'
method: probed
source:
- https://www.drinkaccelerator.com/.well-known/openid-configuration
- https://www.drinkaccelerator.com/.well-known/oauth-authorization-server
- https://www.drinkaccelerator.com/api/ucp/mcp
- https://www.drinkaccelerator.com/api/2026-07/graphql.json
docs: https://www.drinkaccelerator.com/agents.md
note: >-
  Derived from live probes, not from an OpenAPI document - this company publishes no
  spec. derive-authentication.py found 0 schemes because there is no openapi/
  directory; this file records the auth model actually observed on the wire.
summary:
  types: [none, oauth2, openIdConnect, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
  anonymous_surfaces: 3
schemes:
- name: anonymous-ucp-mcp
  type: none
  applies_to: https://www.drinkaccelerator.com/api/ucp/mcp
  observed: tools/list returned HTTP 200 with all thirteen tools and their input schemas
    without any credential.
  note: >-
    tools/call is not anonymous in practice - it requires meta.ucp-agent.profile to
    be a resolvable URI. That is an agent-identity control, not an authentication
    control: no secret is exchanged and no account exists. Payment additionally
    enforces a human buyer-approval invariant, which is a policy control.
- name: anonymous-storefront-graphql
  type: none
  applies_to: https://www.drinkaccelerator.com/api/2026-07/graphql.json
  observed: Full introspection returned HTTP 200 (428 types) with no X-Shopify-Storefront-Access-Token
    header. Versions 2026-07, 2026-04, 2025-01 and 2024-04 all answer anonymously.
  note: Customer-scoped fields still require a customerAccessToken obtained via the
    customerAccessTokenCreate mutation.
- name: anonymous-storefront-json
  type: none
  applies_to: https://www.drinkaccelerator.com/
  observed: /products.json and /collections/all/products.json returned HTTP 200 unauthenticated
    (both empty).
- name: shopify-customer-accounts-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.drinkaccelerator.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/7133691957
  authorizationUrl: https://shopify.com/authentication/7133691957/oauth/authorize
  tokenUrl: https://shopify.com/authentication/7133691957/oauth/token
  end_session_endpoint: https://shopify.com/authentication/7133691957/logout
  jwks_uri: https://shopify.com/authentication/7133691957/.well-known/jwks.json
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  pkce: [S256]
  id_token_signing_alg: [RS256]
  subject_types: [public]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  applies_to: Customer account sign-in on the Accelerator Active Energy storefront
  provider: Shopify Customer Accounts (shop id 7133691957)
  note: >-
    The discovery document is served from the company's own hosts (www.drinkaccelerator.com,
    drinkaccelerator.com, ashoc.com, www.ashoc.com, a-shoc.myshopify.com) but the
    issuer and every endpoint are on shopify.com. The company operates no
    authorization server of its own.
- name: shopify-customer-account-oauth2
  type: oauth2
  source: https://www.drinkaccelerator.com/.well-known/oauth-authorization-server
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/7133691957/oauth/authorize
    tokenUrl: https://shopify.com/authentication/7133691957/oauth/token
    scopes: 4
  note: The RFC 8414 metadata document is byte-identical to the OIDC discovery document.
- name: customer-access-token
  type: apiKey
  in: header
  parameter: X-Shopify-Customer-Access-Token
  applies_to: https://www.drinkaccelerator.com/api/2026-07/graphql.json
  observed: Required by the customer query field per the introspected schema; obtained
    via customerAccessTokenCreate.
  note: Documented by the platform vendor, not by this company.
agent_identity:
  mechanism: UCP agent profile
  field: meta.ucp-agent.profile
  format: URI
  required_on: every tools/call
  enforcement: HTTP 422 with JSON-RPC -32001 invalid_profile_url when absent - observed
    live.
x-evidence:
- url: https://www.drinkaccelerator.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json
- url: https://www.drinkaccelerator.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
- url: https://www.drinkaccelerator.com/api/ucp/mcp
  http_status: 200
  note: anonymous tools/list
- url: https://www.drinkaccelerator.com/api/ucp/mcp
  http_status: 422
  note: tools/call without an agent profile
- url: https://www.drinkaccelerator.com/api/2026-07/graphql.json
  http_status: 200
  note: anonymous full introspection