generated: '2026-08-06'
method: searched
source: https://store-account.agibot.com/.well-known/openid-configuration
docs: https://store.agibot.com/llms.txt
notes: AgiBot has two distinct authentication postures. (1) The AimDK robot protocol carries no authentication
  in the .proto contract itself — RPC request headers hold only a timestamp and an optional blocking flag;
  access control is a property of the robot and its local network, not of the protocol. (2) The store
  commerce surface (UCP/MCP) is anonymous for catalog, cart and checkout tools, and uses OAuth 2.0 / OpenID
  Connect with PKCE for customer-scoped calls.
x-evidence:
  fetched: '2026-08-06'
  url: https://store-account.agibot.com/.well-known/openid-configuration
  http_status: 200
surfaces:
- api: agibot:aimdk-protocol
  scheme: none
  detail: aimdk.protocol.RequestHeader carries a timestamp; BlockableRequestHeader adds a blocked flag.
    No token, key or credential field is defined anywhere in the 136 published .proto files.
  source: grpc/aimdk/protocol/common/header.proto
- api: agibot:aimdk-x2
  scheme: download
  detail: The AimDK_X2 SDK is obtained by self-service download from the documentation site (floating
    panel) or via after-sales technical support. The published documentation does not state a credential,
    licence key or serial-number gate.
  source: https://x2-aimdk.agibot.com/en/latest/get_sdk/index.html
- api: agibot:store-commerce
  scheme: oauth2 + openIdConnect
  detail: Anonymous for catalog/cart/checkout MCP tools; bearer token in the Authorization header for
    customer-scoped calls.
  issuer: https://shopify.com/authentication/62881759275
  authorization_endpoint: https://store-account.agibot.com/authentication/oauth/authorize
  token_endpoint: https://store-account.agibot.com/authentication/oauth/token
  jwks_uri: https://store-account.agibot.com/.well-known/jwks.json
  end_session_endpoint: https://store-account.agibot.com/authentication/logout
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  pkce:
  - S256
  token_endpoint_auth_methods:
  - client_secret_basic
  id_token_signing_alg:
  - RS256
  bearer_methods:
  - header
  protected_resource: https://store.agibot.com
  source: well-known/agibot-openid-configuration.json