generated: '2026-08-11'
method: probed
source: https://davidprotein.com/.well-known/openid-configuration
docs: https://davidprotein.com/agents.md
note: >-
  David publishes no OpenAPI, so this profile is probed from the live discovery documents
  the store serves and from the authentication errors the MCP endpoints actually returned,
  not derived from a spec.
summary:
  types: [oauth2, openIdConnect, http]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  bearer_methods: [header]
  pkce: [S256]
schemes:
- name: customer-account-oauth
  type: oauth2
  source: well-known/david-protein-openid-configuration.json
  issuer: https://shopify.com/authentication/63247417511
  authorization_url: https://account.davidprotein.com/authentication/oauth/authorize
  token_url: https://account.davidprotein.com/authentication/oauth/token
  end_session_url: https://account.davidprotein.com/authentication/logout
  jwks_uri: https://account.davidprotein.com/authentication/.well-known/jwks.json
  token_endpoint_auth_methods: [client_secret_basic]
  code_challenge_methods: [S256]
  id_token_signing_alg: [RS256]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  applies_to: [david-protein-customer-account-mcp]
- name: openid-connect
  type: openIdConnect
  source: well-known/david-protein-openid-configuration.json
  openid_connect_url: https://davidprotein.com/.well-known/openid-configuration
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  subject_types: [public]
- name: ucp-agent-jwt
  type: http
  scheme: bearer
  bearerFormat: JWT
  source: probe of https://davidprotein.com/api/ucp/mcp
  applies_to: [david-protein-ucp-commerce-mcp]
  note: >-
    An anonymous tools/call on the UCP commerce endpoint returns JSON-RPC error -32000
    "AuthenticationRequired" with the message "Unauthorized: A valid JWT is required to
    call <tool>. See https://shopify.dev/docs/agents/get-started/authentication". tools/list
    itself is anonymous.
- name: none
  type: none
  applies_to: [david-protein-storefront-mcp, david-protein-storefront-json]
  note: >-
    The storefront MCP server at /api/mcp answered both tools/list and a search_catalog
    tools/call anonymously on probe, as did every /products.json and /collections.json
    read path documented in agents.md.
protected_resource:
  source: well-known/david-protein-oauth-protected-resource.json
  resource: https://davidprotein.com
  authorization_servers:
  - https://account.davidprotein.com
  - https://shopify.com/authentication/63247417511
  bearer_methods_supported: [header]
x-evidence:
  fetched: '2026-08-11'
  urls:
  - {url: https://davidprotein.com/.well-known/openid-configuration, status: 200}
  - {url: https://davidprotein.com/.well-known/oauth-authorization-server, status: 200}
  - {url: https://davidprotein.com/.well-known/oauth-protected-resource, status: 200}
  - {url: https://account.davidprotein.com/authentication/.well-known/jwks.json, status: 200}