generated: '2026-07-31'
method: probed
source: https://harrys.com/.well-known/openid-configuration
note: >-
  No OpenAPI exists for any Mammoth Brands surface, so this profile was NOT derived from a
  spec. It was probed live: both Shopify-hosted brands serve a real OpenID Connect / RFC 8414
  discovery document from their own apex domain, and the storefront MCP endpoints were
  confirmed to require no authentication at all.
summary:
  types: [oauth2, openIdConnect, none]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  anonymous_surfaces: 2
schemes:
- name: shopify-customer-account-oidc-harrys
  type: openIdConnect
  brand: Harry's
  openIdConnectUrl: https://harrys.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/88395284786
  authorizationUrl: https://shopify.com/authentication/88395284786/oauth/authorize
  tokenUrl: https://shopify.com/authentication/88395284786/oauth/token
  end_session_endpoint: https://shopify.com/authentication/88395284786/logout
  jwks_uri: https://shopify.com/authentication/88395284786/.well-known/jwks.json
  grant_types_supported: [authorization_code, refresh_token]
  response_types_supported: [code]
  token_endpoint_auth_methods_supported: [client_secret_basic]
  id_token_signing_alg_values_supported: [RS256]
  code_challenge_methods_supported: [S256]
  subject_types_supported: [public]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/harry-s-harrys-openid-configuration.json]
- name: shopify-customer-account-oidc-flamingo
  type: openIdConnect
  brand: Flamingo
  openIdConnectUrl: https://www.shopflamingo.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/55874814054
  authorizationUrl: https://shopify.com/authentication/55874814054/oauth/authorize
  tokenUrl: https://shopify.com/authentication/55874814054/oauth/token
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/harry-s-flamingo-openid-configuration.json]
- name: storefront-mcp-anonymous
  type: none
  description: >-
    The Harry's and Flamingo storefront MCP endpoints (/api/mcp) accept an unauthenticated
    JSON-RPC POST. tools/list, search_catalog, get_product_details and the policy search tool
    all answered anonymously on 2026-07-31. Carts are addressed by an opaque cart_id rather
    than by a session token.
  surfaces: ['https://www.harrys.com/api/mcp', 'https://www.shopflamingo.com/api/mcp']
- name: ucp-agent-profile
  type: agent-profile
  description: >-
    The UCP-branded MCP endpoint (/api/ucp/mcp on the myshopify origin) rejects calls without
    an agent profile URI, returning JSON-RPC -32001 UCP discovery failed / invalid_profile_url.
    Agent identity, not a bearer token, is the gate.
  surfaces: ['https://com-harrys-us.myshopify.com/api/ucp/mcp', 'https://shop-flamingo-us.myshopify.com/api/ucp/mcp']
x-evidence:
  fetched: '2026-07-31'
  documents:
  - {url: 'https://harrys.com/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://harrys.com/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://www.shopflamingo.com/.well-known/openid-configuration', http_status: 200}