Acefouraccessories Authentication

generated: '2026-09-06'
method: probed
source: >-
  https://uppercase.co.in/api/ucp/mcp (anonymous tools/list, HTTP 200),
  https://uppercase.co.in/.well-known/openid-configuration,
  https://uppercase.co.in/.well-known/oauth-protected-resource
note: >-
  There is no OpenAPI to derive securitySchemes from, so this profile was probed directly against the
  live surfaces. Two distinct auth planes exist and they are not the same thing: the agent commerce
  plane is anonymous, and the buyer/customer-account plane is OIDC on a Shopify-operated issuer.
summary:
  types: [none, openIdConnect, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
schemes:
- name: ucp-mcp-anonymous
  plane: agent commerce (UCP shopping MCP)
  type: none
  endpoint: https://uppercase.co.in/api/ucp/mcp
  detail: >-
    tools/list and the catalog tools answered with no Authorization header (HTTP 200). No API key,
    bearer token or client registration is required to call the agent surface.
  caller_identification:
    required: true
    parameter: meta.ucp-agent.profile
    format: uri
    detail: >-
      Every tool inputSchema requires meta.ucp-agent.profile, an agent profile URI used for UCP
      agent discovery. It identifies the calling agent but is not a credential and is not verified
      as one.
  verified: probed
- name: shopify-customer-account-oidc
  plane: buyer identity / customer accounts
  type: openIdConnect
  openIdConnectUrl: https://uppercase.co.in/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/67539140858
  authorization_endpoint: https://shopify.com/authentication/67539140858/oauth/authorize
  token_endpoint: https://shopify.com/authentication/67539140858/oauth/token
  jwks_uri: https://shopify.com/authentication/67539140858/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/67539140858/logout
  id_token_signing_alg_values_supported: [RS256]
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post]
  grant_types_supported:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  scopes_supported:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
  detail: >-
    Discovery is served from the company's own host but the issuer, keys and consent screens are
    Shopify's, scoped to shop id 67539140858. See scopes/acefouraccessories-scopes.yml.
  verified: probed
- name: ucp-protected-resource
  plane: resource metadata
  type: oauth2
  detail: >-
    RFC 9728 metadata at /.well-known/oauth-protected-resource names
    resource https://uppercase.co.in with bearer_methods_supported ["header"], pointing at the
    Shopify issuer as the sole authorization server. No bearer token was needed for any call this
    pass actually made.
  verified: probed
payment_authorization:
  detail: >-
    Payment is authorized out of band by the buyer, not by an API credential. /llms.txt states
    agents must not complete payment without explicit buyer consent, and points agents that cannot
    obtain contemporaneous approval at Shop Pay instead.
  handlers: [com.google.pay, dev.shopify.card]