generated: '2026-08-07'
method: probed
source: https://blackbuffalo.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Black Buffalo publishes no OpenAPI, so this profile is built from live discovery
  documents and observed responses rather than derived securitySchemes. Four distinct
  auth postures were observed on 2026-08-07 — and notably, THREE of the four machine
  surfaces answered with no credential at all.
summary:
  types: [none, openIdConnect, oauth2, agentProfile]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
schemes:
- name: anonymous-storefront-graphql
  type: none
  surface: https://blackbuffalo.com/api/2026-04/graphql.json
  observed: >-
    Full GraphQL introspection succeeded with no X-Shopify-Storefront-Access-Token
    header, on three separate API versions. Cost limiting is signalled via
    extensions.cost on every response rather than by an auth challenge.
  sources: [graphql/black-buffalo-graphql.yml]
- name: anonymous-storefront-mcp
  type: none
  surface: https://blackbuffalo.com/api/mcp
  observed: >-
    An unauthenticated JSON-RPC tools/list returned HTTP 200 with five tools and their
    input schemas. No Authorization header, API key or Storefront token required.
  sources: [mcp/black-buffalo-mcp.yml]
- name: anonymous-ucp-mcp-discovery
  type: none
  surface: https://blackbuffalo.com/api/ucp/mcp
  observed: >-
    An unauthenticated tools/list returned HTTP 200 with all thirteen commerce tools,
    including complete_checkout. Discovery of the commerce surface requires no
    credential.
  sources: [mcp/black-buffalo-mcp.yml]
- name: ucp-agent-profile
  type: agentProfile
  surface: https://blackbuffalo.com/api/ucp/mcp
  mechanism: >-
    Every one of the thirteen UCP tools declares meta["ucp-agent"]["profile"] — a
    resolvable agent profile URI — as a REQUIRED input property. resources/list and
    prompts/list already fail without it, returning JSON-RPC error -32001
    "UCP discovery failed" with code invalid_profile_url ("Missing profile uri").
  observed: >-
    Confirmed on 2026-08-07: tools/list is open, but the agent-identity requirement is
    enforced on invocation and on the resource/prompt methods.
  spec: https://ucp.dev/2026-04-08/specification/overview/
  note: >-
    This is agent IDENTITY, not shopper authorization. Payment authorization is separate
    and, per the provider's own robots.txt, must be approved by a human at the time of
    purchase.
  sources: [mcp/black-buffalo-ucp-mcp-tools.json, well-known/black-buffalo-ucp.json]
- name: shopify-customer-accounts
  type: openIdConnect
  openIdConnectUrl: https://blackbuffalo.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/22588521
  authorizationUrl: https://shopify.com/authentication/22588521/oauth/authorize
  tokenUrl: https://shopify.com/authentication/22588521/oauth/token
  end_session_endpoint: https://shopify.com/authentication/22588521/logout
  jwks_uri: https://shopify.com/authentication/22588521/.well-known/jwks.json
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic]
  pkce: [S256]
  id_token_signing_alg: [RS256]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/black-buffalo-openid-configuration.json]
- name: shopify-customer-accounts-oauth2
  type: oauth2
  note: >-
    The same authorization server also publishes RFC 8414 metadata at
    /.well-known/oauth-authorization-server (byte-identical document), so the surface is
    usable as plain OAuth 2.0 as well as OIDC.
  sources: [well-known/black-buffalo-oauth-authorization-server.json]
- name: storefront-customer-access-token
  type: http
  scheme: bearer
  surface: https://blackbuffalo.com/api/2026-04/graphql.json
  header: X-Shopify-Customer-Access-Token
  mechanism: >-
    The Storefront GraphQL schema itself carries a legacy shopper-token flow —
    customerAccessTokenCreate / customerAccessTokenRenew / customerAccessTokenDelete
    mutations, consumed by the customer query and the customer* mutations. Distinct from
    the OIDC customer-accounts flow above.
  sources: [graphql/black-buffalo-storefront.graphql]
age_gating:
  present: true
  surface: human web only
  detail: >-
    Black Buffalo sells a nicotine product restricted to adults 21+ and runs age
    verification on the storefront (/pages/verify-age, /pages/verify-age-ca). NO age or
    eligibility assertion is required, offered, or checked on any of the machine
    surfaces — the anonymous GraphQL, Storefront MCP and UCP MCP endpoints all answered
    without one. /agents.md states the restriction in prose and instructs agents not to
    recommend the products to anyone under 21, but that instruction is unenforced at the
    protocol layer.
  note: >-
    Recorded as an observed fact about the auth surface, not as a compliance finding.
x-evidence:
- fetched: '2026-08-07'
  url: https://blackbuffalo.com/.well-known/openid-configuration
  http_status: 200
- fetched: '2026-08-07'
  url: https://blackbuffalo.com/api/2026-04/graphql.json
  http_status: 200
  note: anonymous introspection
- fetched: '2026-08-07'
  url: https://blackbuffalo.com/api/ucp/mcp
  http_status: 200
  note: anonymous tools/list; resources/list rejected with -32001 invalid_profile_url