generated: '2026-08-25'
method: probed
source: https://www.ministryofsupply.com/.well-known/openid-configuration
docs: https://www.ministryofsupply.com/.well-known/openid-configuration
note: >-
  Scopes are read from the merchant's own OpenID Connect discovery document, served from
  www.ministryofsupply.com. They govern Shopify Customer Accounts (a shopper's own orders and profile),
  not the anonymous UCP/MCP commerce endpoint — that endpoint has no scope surface and requires no token.
schemes:
- name: shopify-customer-accounts-oidc
  source: well-known/ministry-of-supply-openid-configuration.json
  issuer: https://shopify.com/authentication/3092321
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/3092321/oauth/authorize
    tokenUrl: https://shopify.com/authentication/3092321/oauth/token
scope_count: 4
scopes:
- scope: openid
  description: Standard OpenID Connect scope; issues an ID token for the authenticated shopper.
  flows: [authorizationCode]
  sources: [well-known/ministry-of-supply-openid-configuration.json]
- scope: email
  description: Releases the shopper's email and email_verified claims.
  flows: [authorizationCode]
  sources: [well-known/ministry-of-supply-openid-configuration.json]
- scope: customer-account-api:full
  description: Full access to the Shopify Customer Account API for the authenticated shopper.
  flows: [authorizationCode]
  sources: [well-known/ministry-of-supply-openid-configuration.json]
- scope: customer-account-mcp-api:full
  description: >-
    Full access to the Shopify Customer Account MCP API for the authenticated shopper — the
    account-scoped agent surface, distinct from the anonymous storefront UCP/MCP endpoint.
  flows: [authorizationCode]
  sources: [well-known/ministry-of-supply-openid-configuration.json]