generated: '2026-07-19'
method: searched
source: >-
  Live /.well-known/openid-configuration + /.well-known/oauth-authorization-server
  + /.well-known/ucp + Storefront MCP initialize handshake
description: >-
  Cross-cutting standards conformance for the Shopify-hosted Face Reality
  Skincare store, asserted from live discovery documents and protocol
  handshakes. Each entry records whether the surface conforms and the observed
  evidence.
standards:
- id: oauth2
  conforms: true
  evidence: >-
    OAuth 2.0 Authorization Server metadata served at
    /.well-known/oauth-authorization-server with authorization_endpoint,
    token_endpoint, and grant_types_supported (authorization_code, refresh_token,
    jwt-bearer).
- id: oidc
  conforms: true
  evidence: >-
    OpenID Connect discovery document at /.well-known/openid-configuration with
    issuer, jwks_uri, id_token_signing_alg_values_supported (RS256), and OIDC
    claims_supported.
- id: pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256 in the discovery document.
- id: mcp
  conforms: true
  evidence: >-
    JSON-RPC 2.0 MCP server at /api/mcp responds to initialize with
    protocolVersion 2025-06-18 and tools/prompts/resources capabilities
    (serverInfo storefront-renderer 0.1.0).
- id: ucp
  conforms: true
  evidence: >-
    Universal Commerce Protocol merchant profile at /.well-known/ucp declares
    supported versions 2026-04-08 and 2026-01-23 with dev.ucp.shopping services
    and checkout/cart/fulfillment/discount capabilities.
- id: rfc9457
  conforms: false
  evidence: No application/problem+json error surface observed; no OpenAPI published for this store.