generated: '2026-08-04'
method: probed
source: https://shop.fnatic.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Fnatic has no OpenAPI to derive scopes from. These are the scopes the authorization
  server behind the Fnatic Shop's customer accounts actually advertises in its OIDC /
  RFC 8414 discovery documents (scopes_supported), fetched anonymously on 2026-08-04.
  Fnatic publishes no scope reference page of its own.
schemes:
  - name: shopify-customer-accounts
    source: well-known/fnatic-openid-configuration.json
    issuer: https://shopify.com/authentication/54359195821
    flows:
      - flow: authorizationCode
        authorizationUrl: https://shopify.com/authentication/54359195821/oauth/authorize
        tokenUrl: https://shopify.com/authentication/54359195821/oauth/token
        pkce: S256
scopes:
  - scope: openid
    description: Standard OpenID Connect scope — issues an ID token identifying the shopper.
    flows: [authorizationCode]
    sources: [well-known/fnatic-openid-configuration.json]
  - scope: email
    description: Releases the email and email_verified claims for the authenticated shopper.
    flows: [authorizationCode]
    sources: [well-known/fnatic-openid-configuration.json]
  - scope: customer-account-api:full
    description: >-
      Full access to the Shopify Customer Account API on behalf of the signed-in
      shopper — orders, addresses and profile for that customer of the Fnatic Shop.
    flows: [authorizationCode]
    sources: [well-known/fnatic-openid-configuration.json]
  - scope: customer-account-mcp-api:full
    description: >-
      Full access to the Customer Account MCP API — the authenticated, per-shopper MCP
      surface. Distinct from the store-level UCP MCP endpoint at /api/ucp/mcp, which is
      gated on an agent profile rather than a shopper scope.
    flows: [authorizationCode]
    sources: [well-known/fnatic-openid-configuration.json]
notes:
  - >-
    These scopes govern the SHOPPER-delegated surface only. The anonymous Storefront
    GraphQL endpoint requires no scope at all — full introspection and catalog reads
    succeed unauthenticated.
  - >-
    Fnatic's own member accounts on fnatic.com (Fnatic ID) publish no scopes and no
    OAuth/OIDC discovery document.
x-evidence:
  fetched: '2026-08-04'
  url: https://shop.fnatic.com/.well-known/openid-configuration
  http_status: 200
  field: scopes_supported