generated: '2026-08-12'
method: probed
source: >-
  https://finesse.us/.well-known/openid-configuration,
  https://finesse.us/.well-known/oauth-authorization-server,
  https://finesse.us/.well-known/oauth-protected-resource,
  https://finesse.us/agents.md, live POST to https://finesse.us/api/ucp/mcp
note: >-
  FINESSE publishes no developer API keys and no partner credential program. There are two distinct
  auth postures on the surface: the agent commerce endpoint, which is anonymous-but-profiled, and
  the customer account identity provider, which is a full OIDC/OAuth 2.0 authorization server
  scoped to this merchant.
surfaces:
  - name: FINESSE UCP Commerce MCP
    url: https://finesse.us/api/ucp/mcp
    scheme: none (agent-profile assertion)
    credentials_required: false
    detail: >-
      tools/list is fully anonymous — HTTP 200 with complete inputSchemas on 2026-08-12 with no
      Authorization header. Tool CALLS require a `meta.ucp-agent.profile` URI identifying the calling
      agent; a call without it fails with JSON-RPC -32001 / invalid_profile_url. This is an agent
      identity assertion, not a secret: there is no key to issue, rotate or revoke, and there is no
      published registration step. Authorization for the sensitive step (payment) is enforced out of
      band by requiring contemporaneous human buyer approval rather than by a token scope.
    evidence:
      http_status: 200
      observed: '2026-08-12'
  - name: FINESSE Customer Accounts (Shopify-hosted OIDC)
    url: https://account.finesse.us/
    scheme: openIdConnect
    credentials_required: true
    detail: >-
      A full OIDC provider for FINESSE shoppers, discoverable at both
      /.well-known/openid-configuration and /.well-known/oauth-authorization-server (RFC 8414) on
      finesse.us, and again on account.finesse.us. Endpoints are on account.finesse.us; the issuer
      is a per-merchant Shopify identity (https://shopify.com/authentication/23733469261). This is
      end-user login, not developer access.
    oidc:
      issuer: https://shopify.com/authentication/23733469261
      authorization_endpoint: https://account.finesse.us/authentication/oauth/authorize
      token_endpoint: https://account.finesse.us/authentication/oauth/token
      end_session_endpoint: https://account.finesse.us/authentication/logout
      jwks_uri: https://account.finesse.us/authentication/.well-known/jwks.json
      response_types_supported: [code]
      grant_types_supported:
        - authorization_code
        - refresh_token
        - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
      token_endpoint_auth_methods_supported: [client_secret_basic]
      code_challenge_methods_supported: [S256]
      id_token_signing_alg_values_supported: [RS256]
      subject_types_supported: [public]
      claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
      scopes_supported:
        - openid
        - email
        - 'customer-account-api:full'
        - 'customer-account-mcp-api:full'
    protected_resource:
      resource: https://finesse.us
      authorization_servers:
        - https://account.finesse.us
        - https://shopify.com/authentication/23733469261
      bearer_methods_supported: [header]
      spec: RFC 9728
security_schemes_summary:
  apiKey: false
  http_bearer: true          # via the OIDC access token on the customer-account surface
  oauth2: true
  openIdConnect: true
  mutualTLS: false
  none: true                 # anonymous tools/list on the MCP endpoint
gaps:
  - No security.txt and no documented credential-rotation or revocation guidance for agents.
  - >-
    No published developer registration: an agent profile URI is self-asserted, so the MCP surface
    has identification without authentication. That is by design in UCP 2026-04-08, but it means
    rate limiting is per IP rather than per credential.
  - >-
    The customer-account MCP API implied by the `customer-account-mcp-api:full` scope is not
    documented on any FINESSE-controlled page; it is discoverable only from the OAuth metadata.