Bobbie OAuth Scopes

generated: '2026-08-02'
method: probed
source: https://www.hibobbie.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Bobbie has no OpenAPI to derive scopes from. These are the scopes the authorization
  server behind Bobbie's customer accounts actually advertises in its OIDC/RFC 8414
  discovery document (scopes_supported), fetched anonymously on 2026-08-02.
schemes:
  - name: shopify-customer-accounts
    source: well-known/bobbie-openid-configuration.json
    issuer: https://shopify.com/authentication/6622806101
    flows:
      - flow: authorizationCode
        authorizationUrl: https://account.hibobbie.com/authentication/oauth/authorize
        tokenUrl: https://account.hibobbie.com/authentication/oauth/token
        pkce: S256
scopes:
  - scope: openid
    description: Standard OpenID Connect scope — issues an ID token identifying the shopper.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: email
    description: Releases the email and email_verified claims for the authenticated shopper.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: customer-account-api:full
    description: >-
      Full access to the Shopify Customer Account API on behalf of the signed-in
      shopper — orders, subscriptions, addresses and profile for that customer.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: customer-account-mcp-api:full
    description: >-
      Full access to the Customer Account MCP API — the authenticated, per-shopper MCP
      surface, distinct from the anonymous storefront MCP server at /api/mcp.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
notes:
  - >-
    These scopes govern the SHOPPER-delegated surface only. The anonymous storefront
    GraphQL and MCP endpoints require no scope at all.
  - >-
    Bobbie publishes no scope reference page of its own; the governing documentation is
    Shopify's customer-accounts documentation.
x-evidence:
  fetched: '2026-08-02'
  url: https://www.hibobbie.com/.well-known/openid-configuration
  http_status: 200
  field: scopes_supported