generated: '2026-08-26'
method: probed
source:
- https://www.getquip.com/.well-known/openid-configuration
- https://www.getquip.com/.well-known/oauth-authorization-server
- https://www.getquip.com/.well-known/oauth-protected-resource
- https://www.getquip.com/api/ucp/mcp
- https://www.getquip.com/api/2026-07/graphql.json
docs: https://www.getquip.com/agents.md
note: >-
  Derived from live probes, not from an OpenAPI document — quip publishes no spec, so
  derive-authentication.py has no openapi/ directory to read. This file records the auth
  model actually observed on the wire against quip's own hosts.
summary:
  types: [none, oauth2, openIdConnect, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
  anonymous_surfaces: 3
schemes:
- name: anonymous-ucp-mcp-discovery
  type: none
  applies_to: https://www.getquip.com/api/ucp/mcp
  observed: >-
    initialize and tools/list both returned HTTP 200 with the full 13-tool set and complete
    JSON Schema input schemas, with no credential of any kind.
- name: ucp-agent-profile
  type: apiKey
  in: body
  parameter: meta.ucp-agent.profile
  applies_to: https://www.getquip.com/api/ucp/mcp
  required: true
  observed: >-
    Every tools/call — and prompts/list and resources/list — returns HTTP 422 with JSON-RPC
    error -32001 "UCP discovery failed" (data.code invalid_profile_url, "Missing profile uri")
    unless a resolvable agent profile URI is supplied. This is an identity control, not a
    secret: the value is a public URI the agent publishes about itself, not a bearer token.
  note: >-
    Recorded as apiKey/in:body because no standard scheme type describes it. It is the
    UCP agent-identity mechanism, and it is the only mandatory field on all thirteen tools.
- name: anonymous-storefront-graphql
  type: none
  applies_to: https://www.getquip.com/api/2026-07/graphql.json
  observed: >-
    Full introspection returned HTTP 200 (415 types, 34 query root fields, 41 mutations)
    with no X-Shopify-Storefront-Access-Token header.
  note: >-
    Customer-scoped fields still require a customerAccessToken obtained via the
    customerAccessTokenCreate mutation.
- name: anonymous-storefront-json
  type: none
  applies_to: https://www.getquip.com/
  observed: >-
    /products.json?limit=3 and /collections/all/products.json?limit=2 both returned HTTP 200
    unauthenticated with real product records.
- name: shopify-customer-accounts-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.getquip.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/57677807690
  authorizationUrl: https://shopify.com/authentication/57677807690/oauth/authorize
  tokenUrl: https://shopify.com/authentication/57677807690/oauth/token
  end_session_endpoint: https://shopify.com/authentication/57677807690/logout
  jwks_uri: https://shopify.com/authentication/57677807690/.well-known/jwks.json
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  pkce: [S256]
  id_token_signing_alg: [RS256]
  subject_types: [public]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  applies_to: Customer account sign-in at https://www.getquip.com/account/login
  provider: Shopify Customer Accounts (shop id 57677807690)
- name: shopify-customer-account-oauth2
  type: oauth2
  source: https://www.getquip.com/.well-known/oauth-authorization-server
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/57677807690/oauth/authorize
    tokenUrl: https://shopify.com/authentication/57677807690/oauth/token
    scopes: 4
  note: The RFC 8414 metadata document is byte-identical to the OIDC discovery document.
- name: customer-access-token
  type: apiKey
  in: header
  parameter: X-Shopify-Customer-Access-Token
  applies_to: https://www.getquip.com/api/2026-07/graphql.json
  observed: >-
    Required by the customer query field per the introspected schema; obtained via
    customerAccessTokenCreate.
  note: Documented by the platform vendor, not by quip.
protected_resource:
  source: https://www.getquip.com/.well-known/oauth-protected-resource
  spec: RFC 9728 OAuth 2.0 Protected Resource Metadata
  resource: https://www.getquip.com
  authorization_servers: ['https://shopify.com/authentication/57677807690']
  bearer_methods_supported: [header]
x-evidence:
- url: https://www.getquip.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json
- url: https://www.getquip.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
- url: https://www.getquip.com/.well-known/oauth-protected-resource
  http_status: 200
  content_type: application/json
- url: https://www.getquip.com/api/ucp/mcp
  http_status: 200
  note: anonymous initialize + tools/list
- url: https://www.getquip.com/api/ucp/mcp
  http_status: 422
  note: tools/call without meta.ucp-agent.profile
- url: https://www.getquip.com/api/2026-07/graphql.json
  http_status: 200
  note: anonymous full introspection