generated: '2026-09-19'
method: searched
source: openapi/makeup-land-openapi.yml (securitySchemes) upgraded from https://makeup.land/auth.md, https://makeup.land/llms-full.txt,
  the RFC 8414/9728 metadata and live 401/400 responses on 2026-09-19
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - query
  oauth2_flows: []
  issuance: manual — bearer issued by a human over email; no self-serve signup, no OAuth flow, no token expiry,
    manual revocation
  anonymous_surface:
  - validateGiftCard
  - listProducts with catalog filters only
  - MCP initialize / tools/list / list_products / validate_gift_card
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: ml_<hex24>
  description: API bearer token issued under `api_tokens`. Prefix `ml_` is required. Per-token scope and `read_only`
    flag govern endpoint + write access.
  sources:
  - openapi/makeup-land-openapi.yml
  issuance: 'Email info@makeup.land (auth.md) or shop@makeup.land (llms-api.txt, MCP README) with operator identity,
    use case, desired scope and read_only preference; an admin issues the token from the api_tokens table. "Median
    turnaround: a few business hours during Israel working hours. There is no SLA today."'
  scopes:
  - full
  - register
  - giftcards
  - proposals
  flags:
  - read_only
  expiry: Tokens do not expire automatically.
  revocation: Manual by email with the token prefix; no self-service revocation endpoint. Revoked tokens return
    401 unauthorized.
  rotation: None in-band — on a 401 treat the credential as invalid, do not auto-retry, request a new token by email.
  discovery:
  - https://makeup.land/.well-known/oauth-protected-resource
  - https://makeup.land/.well-known/oauth-authorization-server
  agent_auth: RFC 8414 metadata carries agent_auth {register_uri mailto:info@makeup.land, identity_types_supported
    [identity_assertion], identity_assertion.methods [email_manual], credentials_issued [api_key]} — the WorkOS
    auth.md pattern; the skill file is saved verbatim at skills/makeup-land-auth.md.
  observed: GET /api/v1/brands without a token -> 401 {"error":"Unauthorized"} (2026-09-19)
- name: phoneIdentifier
  type: apiKey
  in: query
  parameter: phone
  description: Phone number in E.164 format (e.g. `+972501234567`) that selects which customer's resources to return.
    **NOT a credential** — endpoints that accept this also REQUIRE `bearerAuth`. The bearer authenticates the calling
    partner; the phone selects the customer. For POST/PATCH cart-mutation endpoints, the phone goes in the JSON
    body instead of the query string.
  sources:
  - openapi/makeup-land-openapi.yml
  selector_not_credential: true
  location_rule: ?phone= query for GET/DELETE; phone in the JSON body for POST/PATCH cart mutations
  observed: 'The provider: "A bearer without phone is rejected with 400 phone parameter required; a phone without
    bearer is rejected with 401 Unauthorized."'
docs: https://makeup.land/auth.md
error_codes:
  '401': unauthorized
  '403':
  - scope_mismatch
  - read_only_token
  detail: errors/makeup-land-problem-types.yml
scopes_detail: scopes/makeup-land-scopes.yml