generated: '2026-08-26'
method: probed
source: https://www.getrael.com/.well-known/openid-configuration + live POST to https://www.getrael.com/api/ucp/mcp
name: Rael authentication profile
summary: >-
  Rael publishes no developer API keys and runs no developer program. There are exactly two
  authenticated/anonymous surfaces on its domain, and they are unrelated to each other: the
  agent commerce MCP endpoint, which is ANONYMOUS, and Shopify Customer Accounts, an OIDC
  provider for shoppers signing in to their own order history.
schemes:
- id: mcp-anonymous
  surface: https://www.getrael.com/api/ucp/mcp
  type: none
  description: >-
    tools/list returned HTTP 200 with the full tool manifest on an unauthenticated POST — no
    WWW-Authenticate header, no OAuth challenge, no invalid_token error. Agents discover and
    call the catalog surface with no credential. Payment is not authorized by a token: the
    UCP payment handlers (Google Pay, Shopify card, Shop Pay) require contemporaneous buyer
    approval at complete_checkout, which is the access control on the write path.
  evidence:
    http_status: 200
    auth_challenge: none
    probed: '2026-08-26'
- id: shopify-customer-accounts
  surface: https://shopify.com/authentication/22463213
  type: openIdConnect
  description: >-
    Shopper sign-in for Rael's store, discovered at /.well-known/openid-configuration on Rael's
    own domain. Issuer is Shopify, scoped to shop id 22463213. Authorization Code with PKCE
    (S256), RS256 id_tokens, client_secret_basic/client_secret_post token auth, and a
    jwt-bearer grant. This is a customer login, not a developer credential — a third party
    cannot register a client against it from a public page.
  endpoints:
    issuer: https://shopify.com/authentication/22463213
    authorization_endpoint: https://shopify.com/authentication/22463213/oauth/authorize
    token_endpoint: https://shopify.com/authentication/22463213/oauth/token
    end_session_endpoint: https://shopify.com/authentication/22463213/logout
    jwks_uri: https://shopify.com/authentication/22463213/.well-known/jwks.json
  grant_types:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  pkce: [S256]
  id_token_signing: [RS256]
  scopes: see scopes/rael-scopes.yml
  human_login: https://www.getrael.com/account/login
not_present:
- API keys or a key-issuance console
- A developer portal, app registration, or client credentials flow open to third parties
- mTLS