generated: '2026-08-29'
method: probed
source: https://shop.tamaramellon.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
summary: >-
  Tamara Mellon publishes no first-party API and therefore no first-party authentication model. The
  only authentication surface reachable on a host the company controls is the Shopify Customer Account
  OAuth 2.0 / OpenID Connect provider that Shopify mounts for every storefront, discovered at
  shop.tamaramellon.com/.well-known/openid-configuration and scoped to this shop (id 11034464). It
  authenticates the brand's own retail customers into their account; it is not a developer-facing API
  credential surface, and no client registration, key issuance, or developer program exists.
first_party_api: false
schemes:
- id: shopify_customer_account_oidc
  type: openIdConnect
  first_party: false
  operator: Shopify
  openid_configuration: https://shop.tamaramellon.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/11034464
  authorization_endpoint: https://shopify.com/authentication/11034464/oauth/authorize
  token_endpoint: https://shopify.com/authentication/11034464/oauth/token
  end_session_endpoint: https://shopify.com/authentication/11034464/logout
  jwks_uri: https://shopify.com/authentication/11034464/.well-known/jwks.json
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  pkce:
    required_methods:
    - S256
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg:
  - RS256
  bearer_methods_supported:
  - header
  protected_resource: https://shop.tamaramellon.com
  claims:
  - iss
  - sub
  - aud
  - exp
  - iat
  - nonce
  - sid
  - email
  - email_verified
notes:
- The store is password-gated, so the authorization endpoints cannot be exercised end to end.
- No API keys, no personal access tokens, no developer application registration is published.