generated: '2026-08-22'
method: probed
source: https://shop.hodinkee.com/.well-known/openid-configuration
docs: https://shop.hodinkee.com/agents.md
name: HODINKEE Shop authentication profile
description: >-
  Hodinkee publishes no API keys, no developer registration and no API auth
  documentation of its own. The auth profile below is read from the live OAuth /
  OpenID metadata the commerce host serves, plus direct anonymous probes of the
  two MCP endpoints on 2026-08-22.
summary:
  anonymous_surface: true
  api_keys: false
  developer_registration: false
  note: >-
    Catalog search, cart and checkout creation over MCP required no credential
    at all. Only customer-scoped operations sit behind OAuth.
schemes:
- id: anonymous
  type: none
  applies_to:
  - https://shop.hodinkee.com/api/ucp/mcp
  - https://shop.hodinkee.com/api/mcp
  - https://shop.hodinkee.com/products.json
  - https://shop.hodinkee.com/collections/{handle}/products.json
  evidence: >-
    POST tools/list returned HTTP 200 with the full tool set on both MCP
    endpoints with no Authorization header. tools/call search_catalog on
    /api/mcp returned real HODINKEE product data anonymously.
  probed: '2026-08-22'
- id: shopify-customer-account-oauth
  type: oauth2
  flow: authorization_code
  pkce: S256
  issuer: https://shopify.com/authentication/1460732
  authorization_endpoint: https://shopify.com/authentication/1460732/oauth/authorize
  token_endpoint: https://shopify.com/authentication/1460732/oauth/token
  end_session_endpoint: https://shopify.com/authentication/1460732/logout
  jwks_uri: https://shopify.com/authentication/1460732/.well-known/jwks.json
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg:
  - RS256
  scopes:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
  applies_to:
  - Shopify Customer Account API for shop 1460732
  - Customer-scoped MCP API (customer-account-mcp-api:full)
  evidence: well-known/hodinkee-shop-openid-configuration.json
- id: ucp-agent-profile
  type: agent-identity
  applies_to:
  - https://shop.hodinkee.com/api/ucp/mcp
  description: >-
    Not a credential, but a required identity assertion. Every UCP tool takes a
    mandatory `meta.ucp-agent.profile` URI. Calling tools/call without one
    returns HTTP 422 and JSON-RPC error -32001
    (data.code "invalid_profile_url", "Unable to fetch agent profile"). The
    agent identifies itself by publishing a profile document, not by presenting
    a secret.
  probed: '2026-08-22'
protected_resource:
  rfc: RFC 9728
  resource: https://shop.hodinkee.com
  authorization_servers:
  - https://shopify.com/authentication/1460732
  bearer_methods_supported:
  - header
  file: well-known/hodinkee-shop-oauth-protected-resource.json
ownership_note: >-
  The authorization server is Shopify's, scoped to Hodinkee's shop id (1460732).
  Hodinkee neither operates nor documents an identity provider of its own.
checked: '2026-08-22'