Also Authentication

generated: '2026-08-02'
method: searched
source: https://ridealso.com/.well-known/openid-configuration
docs: https://ridealso.com/agents.md
summary:
  types: [none, oauth2, openIdConnect, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
  note: The Storefront GraphQL API on ridealso.com answered a full introspection query
    with NO access token on 2026-08-02, so the read surface is effectively anonymous.
    OAuth2/OIDC covers customer accounts; the UCP MCP endpoint gates on an agent
    profile URI rather than a bearer token.
schemes:
- name: anonymous-storefront
  type: none
  applies_to:
  - openapi/also-storefront-json-openapi.yml
  - graphql/also-storefront-2026-07.graphql
  description: Read-only product, collection, cart and search access requires no
    credential. Storefront GraphQL introspection and queries were confirmed open.
  evidence:
    url: https://ridealso.com/api/2026-07/graphql.json
    http_status: 200
    probe: full __schema introspection with no X-Shopify-Storefront-Access-Token
- name: shopify-customer-accounts-oidc
  type: openIdConnect
  openIdConnectUrl: https://ridealso.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/74758783200
  authorization_endpoint: https://shopify.com/authentication/74758783200/oauth/authorize
  token_endpoint: https://shopify.com/authentication/74758783200/oauth/token
  jwks_uri: https://shopify.com/authentication/74758783200/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/74758783200/logout
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic]
  code_challenge_methods: [S256]
  id_token_signing_alg: [RS256]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/also-openid-configuration.json]
- name: also-idp-cognito
  type: oauth2
  description: ALSO runs its own branded identity provider at idp.ridealso.com (AWS
    Cognito hosted UI) for the Continue with Google and Continue with Apple buttons
    on the storefront account login. Discovery documents are not served at the custom
    domain; the authorize endpoint and requested scopes were observed in the login
    links on ridealso.com.
  authorization_endpoint: https://idp.ridealso.com/oauth2/authorize
  token_endpoint: https://idp.ridealso.com/oauth2/token
  userinfo_endpoint: https://idp.ridealso.com/oauth2/userInfo
  logout_endpoint: https://idp.ridealso.com/logout
  flows:
  - flow: authorizationCode
    scopes: [openid, email, profile]
    redirect_uri: https://ridealso.com/apps/tools/auth/callback
  identity_providers: [Google, SignInWithApple]
  evidence:
    source: https://ridealso.com/ (rendered login links)
    authorize_probe: {url: 'https://idp.ridealso.com/oauth2/authorize', http_status: 302}
    discovery_probe: {url: 'https://idp.ridealso.com/.well-known/openid-configuration',
      http_status: 404}
- name: ucp-agent-profile
  type: apiKey
  in: header
  parameter_name: UCP-Agent
  applies_to: [mcp/also-mcp.yml]
  description: Every call to the UCP MCP endpoint must carry `meta.ucp-agent.profile`
    (HTTP `UCP-Agent` header), a URI resolving to the calling platform's own UCP
    profile document. It is an agent identity assertion rather than a secret. Omitting
    it returns JSON-RPC error -32001 invalid_profile_url with HTTP 422.
  evidence:
    url: https://ridealso.com/api/ucp/mcp
    http_status: 422
    schema: https://ucp.dev/2026-04-08/services/shopping/mcp.openrpc.json#/components/schemas/meta
buyer_consent:
  required: true
  statement: Checkout requires human approval. Agents must not complete payment without
    explicit buyer consent.
  source: https://ridealso.com/agents.md