Bobbie Authentication

generated: '2026-08-02'
method: probed
source: https://www.hibobbie.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Bobbie publishes no OpenAPI, so this profile is built from live discovery documents
  and observed responses rather than derived securitySchemes. Three distinct auth
  postures were observed on 2026-08-02.
summary:
  types: [none, openIdConnect, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
schemes:
  - name: anonymous-storefront-mcp
    type: none
    surface: https://www.hibobbie.com/api/mcp
    observed: >-
      An unauthenticated JSON-RPC tools/list returned HTTP 200 with the full tool set
      and input schemas. No Authorization header, API key or Storefront token required.
    sources: [mcp/bobbie-mcp.yml]
  - name: anonymous-storefront-graphql
    type: none
    surface: https://www.hibobbie.com/api/2026-04/graphql.json
    observed: >-
      Full GraphQL introspection succeeded with no X-Shopify-Storefront-Access-Token
      header. Rate/cost limiting is signalled via extensions.cost on every response.
    sources: [graphql/bobbie-graphql.yml]
  - name: shopify-customer-accounts
    type: openIdConnect
    openIdConnectUrl: https://www.hibobbie.com/.well-known/openid-configuration
    issuer: https://shopify.com/authentication/6622806101
    authorizationUrl: https://account.hibobbie.com/authentication/oauth/authorize
    tokenUrl: https://account.hibobbie.com/authentication/oauth/token
    end_session_endpoint: https://account.hibobbie.com/authentication/logout
    jwks_uri: https://account.hibobbie.com/authentication/.well-known/jwks.json
    grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
    response_types: [code]
    token_endpoint_auth_methods: [client_secret_basic]
    pkce: [S256]
    id_token_signing_alg: [RS256]
    claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
    scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
    sources: [well-known/bobbie-openid-configuration.json]
  - name: shopify-customer-accounts-oauth2
    type: oauth2
    note: >-
      The same authorization server also publishes RFC 8414 metadata at
      /.well-known/oauth-authorization-server (byte-identical document), so the surface
      is usable as plain OAuth 2.0 as well as OIDC.
    sources: [well-known/bobbie-oauth-authorization-server.json]
  - name: ucp-agent-profile
    type: other
    surface: https://www.hibobbie.com/api/ucp/mcp
    observed: >-
      tools/list without an agent profile URI returns JSON-RPC -32001
      "UCP discovery failed" / invalid_profile_url. The UCP commerce surface therefore
      requires an agent to present a resolvable profile before any tool call, and
      checkout completion additionally requires contemporaneous buyer approval
      (see agentic-access/).
    spec: https://ucp.dev/2026-04-08/specification/overview/
    sources: [well-known/bobbie-ucp.json, llms/bobbie-llms.txt]
platform:
  vendor: Shopify
  note: >-
    The identity provider is Shopify's, bound to Bobbie's shop id 6622806101 and served
    from Bobbie's account.hibobbie.com vanity domain.
x-evidence:
  - fetched: '2026-08-02'
    url: https://www.hibobbie.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
  - fetched: '2026-08-02'
    url: https://www.hibobbie.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json