Dolls Kill · OAuth Scopes

Dolls Kill OAuth Scopes

OAuth 2.0 searched

Dolls Kill publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Dolls Kill API on a user’s behalf.

Tokens are issued from https://account.dollskill.com/authentication/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyRetailE-commerceFashionApparelCommerceShopifyAgentic CommerceUniversal Commerce ProtocolMCPGraphQLDirect to Consumer

Scopes: 4 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://account.dollskill.com/authentication/oauth/authorize

Token URL
https://account.dollskill.com/authentication/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	Standard OpenID Connect scope; requests an ID token identifying the signed-in customer.	authorizationCode
email	Access to the customer's email address and email_verified claim.	authorizationCode
customer-account-api:full	Full access to the Shopify Customer Account API for the authenticated customer — orders, addresses, payment methods and profile. Observed in the live login redirect issued by account.dollskill.com, which requests openid+email+customer-account-api:full.	authorizationCode
customer-account-mcp-api:full	Full access to the Customer Account MCP API — the authenticated, customer-scoped counterpart to the anonymous UCP commerce MCP endpoint at /api/ucp/mcp. This is the scope an agent would need to read a buyer's own order history rather than only transact on the public catalog.	authorizationCode

📄 Provider scope reference: https://www.dollskill.com/.well-known/oauth-authorization-server

Source

OAuth Scopes

generated: '2026-08-12'
method: searched
source: https://www.dollskill.com/.well-known/openid-configuration
docs: https://www.dollskill.com/.well-known/oauth-authorization-server
note: 'Not derived from OpenAPI — Dolls Kill publishes none. These scopes were read
  verbatim from the scopes_supported array of the live OpenID Connect discovery document
  the storefront serves, confirmed identical on the RFC 8414 authorization-server
  metadata document and observed again in the live login redirect from
  https://account.dollskill.com/.'
schemes:
- name: Customer Account OAuth 2.0
  source: https://www.dollskill.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/63463358721
  flows:
  - flow: authorizationCode
    authorizationUrl: https://account.dollskill.com/authentication/oauth/authorize
    tokenUrl: https://account.dollskill.com/authentication/oauth/token
    pkce: S256
scopes:
- scope: openid
  description: Standard OpenID Connect scope; requests an ID token identifying the
    signed-in customer.
  flows: [authorizationCode]
  sources: ['https://www.dollskill.com/.well-known/openid-configuration']
- scope: email
  description: Access to the customer's email address and email_verified claim.
  flows: [authorizationCode]
  sources: ['https://www.dollskill.com/.well-known/openid-configuration']
- scope: customer-account-api:full
  description: Full access to the Shopify Customer Account API for the authenticated
    customer — orders, addresses, payment methods and profile. Observed in the live
    login redirect issued by account.dollskill.com, which requests openid+email+customer-account-api:full.
  flows: [authorizationCode]
  sources: ['https://www.dollskill.com/.well-known/openid-configuration']
- scope: customer-account-mcp-api:full
  description: Full access to the Customer Account MCP API — the authenticated,
    customer-scoped counterpart to the anonymous UCP commerce MCP endpoint at
    /api/ucp/mcp. This is the scope an agent would need to read a buyer's own order
    history rather than only transact on the public catalog.
  flows: [authorizationCode]
  sources: ['https://www.dollskill.com/.well-known/openid-configuration']
scope_count: 4
observations:
- 'The scope surface is coarse — both API scopes are :full, with no read/write or
  per-resource split. An agent granted customer-account-api:full receives the whole
  customer record.'
- 'The public UCP commerce MCP endpoint requires no OAuth scope at all; it is gated
  on a UCP agent profile URI instead. OAuth applies only to customer-account surfaces.'
x-evidence:
- url: https://www.dollskill.com/.well-known/openid-configuration
  status: 200
- url: https://account.dollskill.com/
  status: 200
  note: redirects to /authentication/login with scope=openid+email+customer-account-api%3Afull