generated: '2026-08-26'
method: probed
source: https://modretro.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/agents/get-started/authentication
note: >-
  ModRetro publishes no OpenAPI, so this profile is built from the two authentication surfaces the
  company actually serves: the OIDC / RFC 8414 discovery documents at modretro.com/.well-known/ and
  the live authentication behaviour observed on the UCP MCP endpoint. Both are shop-scoped to
  ModRetro (issuer https://shopify.com/authentication/82920341806; endpoints on orders.modretro.com).

summary:
  types: [openIdConnect, oauth2, http]
  oauth2_flows: [authorizationCode, refreshToken, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  pkce: [S256]
  api_key_in: []
  anonymous_surfaces:
    - 'MCP initialize and tools/list (HTTP 200, no credentials)'
    - 'Storefront product/collection JSON (GET /products.json, /collections/{handle}/products.json)'
    - 'Atom blog feed (/blogs/blog.atom)'

schemes:
  - name: ShopifyCustomerAccountOIDC
    type: openIdConnect
    openIdConnectUrl: https://modretro.com/.well-known/openid-configuration
    issuer: https://shopify.com/authentication/82920341806
    authorization_endpoint: https://orders.modretro.com/authentication/oauth/authorize
    token_endpoint: https://orders.modretro.com/authentication/oauth/token
    end_session_endpoint: https://orders.modretro.com/authentication/logout
    jwks_uri: https://orders.modretro.com/authentication/.well-known/jwks.json
    response_types_supported: [code]
    grant_types_supported: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
    token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post]
    code_challenge_methods_supported: [S256]
    id_token_signing_alg_values_supported: [RS256]
    claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
    scopes_supported: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
    sources: [well-known/modretro-openid-configuration.json]
  - name: ShopifyAgentJWT
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to: [get_order, create_checkout, update_checkout, complete_checkout, cancel_checkout]
    docs: https://shopify.dev/docs/agents/get-started/authentication
    evidence: >-
      POST tools/call get_order without a token returned HTTP 403 and JSON-RPC -32000
      "AuthenticationRequired: Unauthorized: A valid JWT is required to call get_order."
    sources: [mcp/modretro-mcp.yml]
  - name: UCPAgentProfile
    type: other
    mechanism: 'meta.ucp-agent.profile (fetchable agent-profile URI on every tools/call)'
    required: true
    evidence: >-
      A tools/call without a resolvable profile URI returns HTTP 422 and JSON-RPC -32001
      "UCP discovery failed" with data.code invalid_profile_url.
    sources: [mcp/modretro-mcp-tools.json]

x-evidence:
  - {url: 'https://modretro.com/.well-known/openid-configuration', http_status: 200, fetched: '2026-08-26'}
  - {url: 'https://modretro.com/.well-known/oauth-authorization-server', http_status: 200, fetched: '2026-08-26'}
  - {url: 'https://orders.modretro.com/authentication/.well-known/jwks.json', http_status: 200, fetched: '2026-08-26'}
  - {url: 'https://modretro.com/api/ucp/mcp', http_status: 403, fetched: '2026-08-26', note: 'AuthenticationRequired on get_order'}