generated: '2026-08-16'
method: probed
source: https://www.flyingembers.com/.well-known/openid-configuration
docs: https://www.flyingembers.com/.well-known/oauth-authorization-server
note: >-
  Derived from the store-scoped OIDC/OAuth 2.0 discovery documents served at the
  merchant's own domain. The UCP/MCP commerce endpoint itself is anonymous and declares
  no scopes; these scopes govern customer-account access only.
schemes:
  - name: shopify-customer-accounts-oidc
    source: well-known/flying-embers-openid-configuration.json
    issuer: https://shopify.com/authentication/35263676475
    flows:
      - flow: authorizationCode
        authorizationUrl: https://shopify.com/authentication/35263676475/oauth/authorize
        tokenUrl: https://shopify.com/authentication/35263676475/oauth/token
        pkce: S256
scopes:
  - scope: openid
    description: OIDC authentication; issues an ID token identifying the signed-in customer.
    flows: [authorizationCode]
    sources: [well-known/flying-embers-openid-configuration.json]
  - scope: email
    description: Release the customer's email address and email_verified claim.
    flows: [authorizationCode]
    sources: [well-known/flying-embers-openid-configuration.json]
  - scope: customer-account-api:full
    description: Full access to the signed-in customer's account API (orders, addresses, profile).
    flows: [authorizationCode]
    sources: [well-known/flying-embers-openid-configuration.json]
  - scope: customer-account-mcp-api:full
    description: >-
      Full access to the customer-account MCP API — the authenticated agent surface that
      sits alongside the anonymous UCP shopping MCP endpoint.
    flows: [authorizationCode]
    sources: [well-known/flying-embers-openid-configuration.json]