Bespoken Spirits Authentication

generated: '2026-08-07'
method: searched
source: https://bespokenspirits.com/.well-known/openid-configuration
docs: https://bespokenspirits.com/agents.md
notes: >-
  Bespoken Spirits publishes no API keys and no developer program. Its machine surface
  splits into three auth postures: (1) fully anonymous read — the storefront product
  JSON endpoints and MCP initialize/tools/list; (2) agent-profile-bound — every
  tools/call on the UCP MCP endpoint requires a caller-hosted UCP agent profile URI in
  meta.ucp-agent.profile, which is a discovery identity rather than a bearer credential;
  (3) OIDC/OAuth 2.0 — the Shopify Customer Account authorization server, used for
  buyer accounts and for the customer-account MCP API. Payment on complete_checkout
  additionally requires contemporaneous human buyer approval, which is an authorization
  gate the protocol enforces rather than a credential.
summary:
  types:
  - none
  - openIdConnect
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - refreshToken
  - urn:ietf:params:oauth:grant-type:jwt-bearer
schemes:
- name: anonymous
  type: none
  description: Storefront catalog JSON (/products.json, /products/{handle}.json,
    /collections/{handle}/products.json) and MCP initialize + tools/list on both
    endpoints require no credential of any kind.
  sources:
  - https://bespokenspirits.com/llms.txt
  - https://bespokenspirits.com/api/ucp/mcp
- name: ucp-agent-profile
  type: agent-identity
  description: JSON-RPC params.meta.ucp-agent.profile — a URI pointing at the calling
    agent's own UCP profile. Required on every tools/call; absent it the server returns
    JSON-RPC -32001 with data.code invalid_profile_url. Not a bearer token and not
    issued by Bespoken Spirits.
  in: json-rpc params
  parameter: meta.ucp-agent.profile
  required: true
  sources:
  - mcp/bespoken-spirits-ucp-mcp-tools.json
- name: shopify-customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://bespokenspirits.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/75681399024
  authorizationUrl: https://shopify.com/authentication/75681399024/oauth/authorize
  tokenUrl: https://shopify.com/authentication/75681399024/oauth/token
  end_session_endpoint: https://shopify.com/authentication/75681399024/logout
  jwks_uri: https://shopify.com/authentication/75681399024/.well-known/jwks.json
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  code_challenge_methods_supported:
  - S256
  id_token_signing_alg_values_supported:
  - RS256
  scopes: scopes/bespoken-spirits-scopes.yml
  sources:
  - well-known/bespoken-spirits-openid-configuration.json
- name: shopify-oauth-protected-resource
  type: oauth2
  description: RFC 9728 protected-resource metadata declaring bespokenspirits.com as
    the resource, the Shopify authentication host as its authorization server, and
    header-borne bearer tokens as the only supported presentation method.
  resource: https://bespokenspirits.com
  authorization_servers:
  - https://shopify.com/authentication/75681399024
  bearer_methods_supported:
  - header
  sources:
  - well-known/bespoken-spirits-oauth-protected-resource.json
x-evidence:
  fetched: '2026-08-07'
  probes:
  - url: https://bespokenspirits.com/.well-known/openid-configuration
    http_status: 200
  - url: https://bespokenspirits.com/.well-known/oauth-protected-resource
    http_status: 200
  - url: https://bespokenspirits.com/api/ucp/mcp
    http_status: 200
    note: tools/call without meta.ucp-agent.profile returns -32001 invalid_profile_url