Black Buffalo · OAuth Scopes

Black Buffalo OAuth Scopes

OAuth 2.0 probed

Black Buffalo publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Black Buffalo API on a user’s behalf.

Tokens are issued from https://shopify.com/authentication/22588521/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyConsumer Packaged GoodsNicotine PouchesSmokeless Tobacco AlternativeEcommerceDirect to ConsumerRetailAgentic CommerceShopifyGraphQLModel Context ProtocolUniversal Commerce Protocol

Scopes: 4 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://shopify.com/authentication/22588521/oauth/authorize

Token URL
https://shopify.com/authentication/22588521/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	Standard OpenID Connect scope — issues an ID token identifying the shopper.	authorizationCode
email	Releases the email and email_verified claims for the authenticated shopper.	authorizationCode
customer-account-api:full	Full access to the Shopify Customer Account API on behalf of the signed-in shopper — orders, addresses and profile for that customer. This is the scope that governs the order history the anonymous Storefront GraphQL schema deliberately does not expose.	authorizationCode
customer-account-mcp-api:full	Full access to the Customer Account MCP API — the authenticated, per-shopper MCP surface, distinct from the two anonymous MCP servers at /api/mcp and /api/ucp/mcp.	authorizationCode

📄 Provider scope reference: https://shopify.dev/docs/api/customer

Source

OAuth Scopes

generated: '2026-08-07'
method: probed
source: https://blackbuffalo.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Black Buffalo has no OpenAPI to derive scopes from. These are the scopes the
  authorization server behind Black Buffalo's customer accounts actually advertises in
  its OIDC / RFC 8414 discovery document (scopes_supported), fetched anonymously on
  2026-08-07.
schemes:
- name: shopify-customer-accounts
  source: well-known/black-buffalo-openid-configuration.json
  issuer: https://shopify.com/authentication/22588521
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/22588521/oauth/authorize
    tokenUrl: https://shopify.com/authentication/22588521/oauth/token
    pkce: S256
scopes:
- scope: openid
  description: Standard OpenID Connect scope — issues an ID token identifying the shopper.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: email
  description: Releases the email and email_verified claims for the authenticated shopper.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: customer-account-api:full
  description: >-
    Full access to the Shopify Customer Account API on behalf of the signed-in shopper —
    orders, addresses and profile for that customer. This is the scope that governs the
    order history the anonymous Storefront GraphQL schema deliberately does not expose.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
- scope: customer-account-mcp-api:full
  description: >-
    Full access to the Customer Account MCP API — the authenticated, per-shopper MCP
    surface, distinct from the two anonymous MCP servers at /api/mcp and /api/ucp/mcp.
  flows: [authorizationCode]
  sources: [well-known/black-buffalo-openid-configuration.json]
notes:
- >-
  These scopes govern the SHOPPER-delegated surface only. The anonymous storefront
  GraphQL server and BOTH MCP servers require no scope at all — see
  authentication/black-buffalo-authentication.yml.
- >-
  The UCP MCP server's access control is not scope-based: it requires a resolvable agent
  profile URI in meta["ucp-agent"].profile, which is an identity assertion rather than a
  delegated permission.
- >-
  Black Buffalo publishes no scope reference page of its own; the governing documentation
  is Shopify's customer-accounts documentation.
x-evidence:
  fetched: '2026-08-07'
  url: https://blackbuffalo.com/.well-known/openid-configuration
  http_status: 200
  field: scopes_supported