generated: '2026-07-31'
method: probed
source: https://hyperice.com/.well-known/openid-configuration
description: >-
  The complete OAuth scope surface Hyperice advertises, taken verbatim from the
  scopes_supported array of the OIDC discovery document served on its own
  domain. Four scopes, all coarse-grained: two OIDC standard scopes and two
  full-access product scopes. There is no fine-grained read/write scope split
  and no per-resource scoping.
docs: https://hyperice.com/.well-known/openid-configuration
schemes:
- name: HypericeCustomerAccounts
  type: openIdConnect
  issuer: https://shopify.com/authentication/78618525910
  source: well-known/hyperice-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://accounts.hyperice.com/authentication/oauth/authorize
    tokenUrl: https://accounts.hyperice.com/authentication/oauth/token
    pkce: S256
scopes:
- scope: openid
  description: >-
    Standard OIDC scope. Authenticates the buyer and requests an ID token
    carrying the iss, sub, aud, exp, iat, nonce and sid claims.
  standard: OpenID Connect Core 1.0
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: email
  description: >-
    Standard OIDC scope. Releases the buyer's email and email_verified claims.
  standard: OpenID Connect Core 1.0
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: customer-account-api:full
  description: >-
    Full access to the Customer Account API on behalf of the signed-in buyer —
    profile, addresses, orders, subscriptions. Coarse-grained: there is no
    read-only or per-resource variant advertised.
  granularity: full
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: customer-account-mcp-api:full
  description: >-
    Full access to the Customer Account MCP API on behalf of the signed-in
    buyer. This is the scope that lets an agent act against buyer-owned data
    over MCP, and it is the highest-consequence grant on the perimeter.
  granularity: full
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
observations:
- >-
  All four scopes are advertised identically by both /.well-known/openid-configuration
  and /.well-known/oauth-authorization-server — the two documents are
  byte-identical on this store.
- >-
  Neither product scope offers a least-privilege alternative. An agent that only
  needs to read order status must request the same :full grant as one that can
  mutate the buyer's profile.
- >-
  The public read tier (products/collections JSON, Storefront GraphQL) requires
  no scope at all, so the scope surface applies solely to buyer-scoped
  operations.
x-evidence:
  fetched: '2026-07-31'
  probes:
  - {url: 'https://hyperice.com/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://hyperice.com/.well-known/oauth-authorization-server', http_status: 200}