generated: '2026-09-12'
method: probed
source: >-
  https://agilitas.com/.well-known/openid-configuration (200),
  https://agilitas.com/.well-known/oauth-protected-resource (200),
  https://agilitas.com/.well-known/ucp (200), live MCP initialize + tools/list on
  https://agilitas.com/api/ucp/mcp (200), https://agilitas.com/llms.txt (200)
name: Agilitas authentication profile
slug: agilitassports

summary: >-
  There is no developer API program, so there is no API key, no client registration and no developer
  credential of any kind. The agent commerce surface is deliberately anonymous at the transport
  layer: initialize, tools/list, catalog search, cart and checkout creation all answer without a
  token. What is required instead is agent IDENTITY (a UCP agent profile URI on every call) and, at
  the moment money moves, a buyer-supplied payment instrument plus contemporaneous human approval.
  A separate OAuth 2.0 / OpenID Connect authorization server exists for shoppers signing in to their
  own customer account; it is Shopify-operated and is not an API-access mechanism.

schemes:
- id: none
  surface: Agilitas Commerce MCP API (https://agilitas.com/api/ucp/mcp)
  type: none
  required: false
  detail: >-
    No Authorization header is sent or accepted on the UCP MCP endpoint. Probed anonymously on
    2026-09-12: initialize HTTP 200, tools/list HTTP 200 returning all 13 tools with full input
    schemas. Also anonymous on https://agilitas.com/api/mcp (storefront policy/FAQ server).

- id: ucp-agent-profile
  surface: Agilitas Commerce MCP API
  type: caller-identity
  required: true
  field: meta.ucp-agent.profile
  format: URI
  applies_to: all 13 UCP tools
  detail: >-
    Not authentication and not authorization — the server does not issue or verify a secret — but it
    IS a hard gate. Every tool declares meta and meta.ucp-agent.profile as required, and a call that
    omits it is rejected before tool logic runs with JSON-RPC error -32001 "UCP discovery failed",
    data.code "invalid_profile_url", data.content "Unable to fetch agent profile: Missing profile
    uri". Observed live on tools/call, prompts/list and resources/list.
  evidence:
    probed: '2026-09-12'
    url: https://agilitas.com/api/ucp/mcp
    http_status: 200

- id: buyer-payment-instrument
  surface: Agilitas Commerce MCP API — checkout
  type: buyer-supplied credential
  required: true for complete_checkout
  detail: >-
    Payment is carried per-call as a checkout payment instrument (handler_id + credential token),
    not as a server credential the agent holds. Declared handlers in the UCP profile are
    com.google.pay (gateway "shopify", gatewayMerchantId 99796025642) and dev.shopify.card accepting
    visa, master, american_express, discover and diners_club. Apple Pay token shape is present in
    the schema branch but no apple-pay handler is advertised in this store's UCP profile.
  human_approval_required: true
  human_approval_source: >-
    https://agilitas.com/llms.txt and https://agilitas.com/robots.txt both state that checkout,
    payment and order placement must not be completed by an agent without an explicit,
    contemporaneous human approval step.

- id: oauth2-oidc-customer-account
  surface: Shopify customer account (shopper sign-in), not the agent API
  type: oauth2
  flows:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  pkce: S256
  issuer: https://shopify.com/authentication/99796025642
  authorization_endpoint: https://shopify.com/authentication/99796025642/oauth/authorize
  token_endpoint: https://shopify.com/authentication/99796025642/oauth/token
  jwks_uri: https://shopify.com/authentication/99796025642/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/99796025642/logout
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg_values_supported:
  - RS256
  scopes_supported:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
  discovery: https://agilitas.com/.well-known/openid-configuration
  protected_resource_metadata: https://agilitas.com/.well-known/oauth-protected-resource
  rfc9728: true
  detail: >-
    Discovery documents are served on the Agilitas domain, but every endpoint they name lives on
    shopify.com and the operator policy/terms URIs in the document are Shopify's
    (op_policy_uri https://www.shopify.com/legal/privacy, op_tos_uri
    https://www.shopify.com/legal/terms). This is Shopify's customer-account identity provider for
    this shop, offered to shoppers, not a developer OAuth program Agilitas runs. No client
    registration path is published, and there is no public client_id for third-party integrators.
  note: >-
    The customer-account-mcp-api:full scope indicates a Shopify-side authenticated customer MCP API
    exists as a product; nothing on an Agilitas host advertises or documents it and it was not
    probed because it requires a customer token.

not_present:
- api_keys
- bearer_tokens_for_the_agent_surface
- mutual_tls
- hmac_request_signing
- developer_client_registration
- partner_or_sandbox_credentials

cross_links:
  scopes: scopes/agilitassports-scopes.yml
  conventions: conventions/agilitassports-conventions.yml
  well_known: well-known/agilitassports-well-known.yml