Bobbie · OAuth Scopes

Bobbie OAuth Scopes

OAuth 2.0 probed

Bobbie publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Bobbie API on a user’s behalf.

Tokens are issued from https://account.hibobbie.com/authentication/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyConsumer Packaged GoodsInfant FormulaEcommerceDirect to ConsumerRetailHealthNutritionAgentic CommerceShopifyGraphQLModel Context Protocol

Scopes: 4 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://account.hibobbie.com/authentication/oauth/authorize

Token URL
https://account.hibobbie.com/authentication/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	Standard OpenID Connect scope — issues an ID token identifying the shopper.	authorizationCode
email	Releases the email and email_verified claims for the authenticated shopper.	authorizationCode
customer-account-api:full	Full access to the Shopify Customer Account API on behalf of the signed-in shopper — orders, subscriptions, addresses and profile for that customer.	authorizationCode
customer-account-mcp-api:full	Full access to the Customer Account MCP API — the authenticated, per-shopper MCP surface, distinct from the anonymous storefront MCP server at /api/mcp.	authorizationCode

📄 Provider scope reference: https://shopify.dev/docs/api/customer

Source

OAuth Scopes

generated: '2026-08-02'
method: probed
source: https://www.hibobbie.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Bobbie has no OpenAPI to derive scopes from. These are the scopes the authorization
  server behind Bobbie's customer accounts actually advertises in its OIDC/RFC 8414
  discovery document (scopes_supported), fetched anonymously on 2026-08-02.
schemes:
  - name: shopify-customer-accounts
    source: well-known/bobbie-openid-configuration.json
    issuer: https://shopify.com/authentication/6622806101
    flows:
      - flow: authorizationCode
        authorizationUrl: https://account.hibobbie.com/authentication/oauth/authorize
        tokenUrl: https://account.hibobbie.com/authentication/oauth/token
        pkce: S256
scopes:
  - scope: openid
    description: Standard OpenID Connect scope — issues an ID token identifying the shopper.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: email
    description: Releases the email and email_verified claims for the authenticated shopper.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: customer-account-api:full
    description: >-
      Full access to the Shopify Customer Account API on behalf of the signed-in
      shopper — orders, subscriptions, addresses and profile for that customer.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
  - scope: customer-account-mcp-api:full
    description: >-
      Full access to the Customer Account MCP API — the authenticated, per-shopper MCP
      surface, distinct from the anonymous storefront MCP server at /api/mcp.
    flows: [authorizationCode]
    sources: [well-known/bobbie-openid-configuration.json]
notes:
  - >-
    These scopes govern the SHOPPER-delegated surface only. The anonymous storefront
    GraphQL and MCP endpoints require no scope at all.
  - >-
    Bobbie publishes no scope reference page of its own; the governing documentation is
    Shopify's customer-accounts documentation.
x-evidence:
  fetched: '2026-08-02'
  url: https://www.hibobbie.com/.well-known/openid-configuration
  http_status: 200
  field: scopes_supported