generated: '2026-08-07'
method: probed
source: https://blackbuffalo.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Black Buffalo has no OpenAPI to derive scopes from. These are the scopes the
  authorization server behind Black Buffalo's customer accounts actually advertises in
  its OIDC / RFC 8414 discovery document (scopes_supported), fetched anonymously on
  2026-08-07.
schemes:
- name: shopify-customer-accounts
  source: well-known/black-buffalo-openid-configuration.json
  issuer: https://shopify.com/authentication/22588521
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/22588521/oauth/authorize
    tokenUrl: https://shopify.com/authentication/22588521/oauth/token
    pkce: S256
scopes:
- scope: openid
  description: Standard OpenID Connect scope — issues an ID token identifying the shopper.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: email
  description: Releases the email and email_verified claims for the authenticated shopper.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: customer-account-api:full
  description: >-
    Full access to the Shopify Customer Account API on behalf of the signed-in shopper —
    orders, addresses and profile for that customer. This is the scope that governs the
    order history the anonymous Storefront GraphQL schema deliberately does not expose.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: customer-account-mcp-api:full
  description: >-
    Full access to the Customer Account MCP API — the authenticated, per-shopper MCP
    surface, distinct from the two anonymous MCP servers at /api/mcp and /api/ucp/mcp.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
notes:
- >-
  These scopes govern the SHOPPER-delegated surface only. The anonymous storefront
  GraphQL server and BOTH MCP servers require no scope at all — see
  authentication/black-buffalo-authentication.yml.
- >-
  The UCP MCP server's access control is not scope-based: it requires a resolvable agent
  profile URI in meta["ucp-agent"].profile, which is an identity assertion rather than a
  delegated permission.
- >-
  Black Buffalo publishes no scope reference page of its own; the governing documentation
  is Shopify's customer-accounts documentation.
x-evidence:
  fetched: '2026-08-07'
  url: https://blackbuffalo.com/.well-known/openid-configuration
  http_status: 200
  field: scopes_supported