Hyperice · OAuth Scopes

Hyperice OAuth Scopes

OAuth 2.0 probed

Hyperice publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Hyperice API on a user’s behalf.

Tokens are issued from https://accounts.hyperice.com/authentication/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyCommerceRetailHealth and WellnessConsumer HardwareSports and FitnessAgentic CommerceGraphQLMCPShopify

Scopes: 4 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://accounts.hyperice.com/authentication/oauth/authorize

Token URL
https://accounts.hyperice.com/authentication/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	Standard OIDC scope. Authenticates the buyer and requests an ID token carrying the iss, sub, aud, exp, iat, nonce and sid claims.	authorizationCode
email	Standard OIDC scope. Releases the buyer's email and email_verified claims.	authorizationCode
customer-account-api:full	Full access to the Customer Account API on behalf of the signed-in buyer — profile, addresses, orders, subscriptions. Coarse-grained: there is no read-only or per-resource variant advertised.	authorizationCode
customer-account-mcp-api:full	Full access to the Customer Account MCP API on behalf of the signed-in buyer. This is the scope that lets an agent act against buyer-owned data over MCP, and it is the highest-consequence grant on the perimeter.	authorizationCode

📄 Provider scope reference: https://hyperice.com/.well-known/openid-configuration

Source

OAuth Scopes

generated: '2026-07-31'
method: probed
source: https://hyperice.com/.well-known/openid-configuration
description: >-
  The complete OAuth scope surface Hyperice advertises, taken verbatim from the
  scopes_supported array of the OIDC discovery document served on its own
  domain. Four scopes, all coarse-grained: two OIDC standard scopes and two
  full-access product scopes. There is no fine-grained read/write scope split
  and no per-resource scoping.
docs: https://hyperice.com/.well-known/openid-configuration
schemes:
- name: HypericeCustomerAccounts
  type: openIdConnect
  issuer: https://shopify.com/authentication/78618525910
  source: well-known/hyperice-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://accounts.hyperice.com/authentication/oauth/authorize
    tokenUrl: https://accounts.hyperice.com/authentication/oauth/token
    pkce: S256
scopes:
- scope: openid
  description: >-
    Standard OIDC scope. Authenticates the buyer and requests an ID token
    carrying the iss, sub, aud, exp, iat, nonce and sid claims.
  standard: OpenID Connect Core 1.0
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: email
  description: >-
    Standard OIDC scope. Releases the buyer's email and email_verified claims.
  standard: OpenID Connect Core 1.0
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: customer-account-api:full
  description: >-
    Full access to the Customer Account API on behalf of the signed-in buyer —
    profile, addresses, orders, subscriptions. Coarse-grained: there is no
    read-only or per-resource variant advertised.
  granularity: full
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
- scope: customer-account-mcp-api:full
  description: >-
    Full access to the Customer Account MCP API on behalf of the signed-in
    buyer. This is the scope that lets an agent act against buyer-owned data
    over MCP, and it is the highest-consequence grant on the perimeter.
  granularity: full
  flows: [authorizationCode]
  sources: [well-known/hyperice-openid-configuration.json]
observations:
- >-
  All four scopes are advertised identically by both /.well-known/openid-configuration
  and /.well-known/oauth-authorization-server — the two documents are
  byte-identical on this store.
- >-
  Neither product scope offers a least-privilege alternative. An agent that only
  needs to read order status must request the same :full grant as one that can
  mutate the buyer's profile.
- >-
  The public read tier (products/collections JSON, Storefront GraphQL) requires
  no scope at all, so the scope surface applies solely to buyer-scoped
  operations.
x-evidence:
  fetched: '2026-07-31'
  probes:
  - {url: 'https://hyperice.com/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://hyperice.com/.well-known/oauth-authorization-server', http_status: 200}