Bombas · Authentication Profile

Bombas Authentication

Authentication

Bombas secures its APIs with oauth2, openIdConnect, and custom-header across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, refreshToken, and jwt-bearer flow(s).

CompanyRetailEcommerceApparelDirect to ConsumerCommerceAgentic CommerceUniversal Commerce ProtocolModel Context ProtocolShopify
Methods: oauth2, openIdConnect, custom-header Schemes: 3 OAuth flows: authorizationCode, refreshToken, jwt-bearer API key in:

Security Schemes

ucp-agent custom-header
· in: header ()
shopify-customer-account-oidc openIdConnect
shopify-oauth-authorization-server oauth2

Source

Authentication Profile

bombas-authentication.yml Raw ↑ 
generated: '2026-07-31'
method: probed
source: https://shop.bombas.com/.well-known/openid-configuration
docs: https://shop.bombas.com/agents.md
summary:
  types: [oauth2, openIdConnect, custom-header]
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
  pkce: [S256]
  api_key_in: []
  note: >-
    Bombas publishes no first-party developer API and issues no API keys. Two
    distinct auth models were observed on the storefront host. (1) The UCP /
    MCP commerce endpoint is not OAuth-gated for discovery; it requires a
    UCP-Agent identity header carrying the calling platform's own UCP profile
    URI, and it defers payment authorization to the buyer. (2) Shopify customer
    accounts on the same host publish full OAuth 2.0 / OpenID Connect discovery.
schemes:
- name: ucp-agent
  type: custom-header
  in: header
  parameter_name: UCP-Agent
  json_rpc_param: meta.ucp-agent.profile
  required: true
  format: uri
  description: >-
    URL to the calling platform's UCP profile document. Required on every UCP
    Shopping Service call; an anonymous call returns JSON-RPC error -32001
    "UCP discovery failed" with data.code invalid_profile_url.
  sources: [mcp/bombas-ucp-shopping-2026-04-08.openrpc.json]
- name: shopify-customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://shop.bombas.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/11195850
  authorizationUrl: https://shopify.com/authentication/11195850/oauth/authorize
  tokenUrl: https://shopify.com/authentication/11195850/oauth/token
  end_session_endpoint: https://shopify.com/authentication/11195850/logout
  jwks_uri: https://shopify.com/authentication/11195850/.well-known/jwks.json
  response_types_supported: [code]
  grant_types_supported: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  token_endpoint_auth_methods_supported: [client_secret_basic]
  code_challenge_methods_supported: [S256]
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [public]
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/bombas-openid-configuration.json]
- name: shopify-oauth-authorization-server
  type: oauth2
  rfc: RFC 8414
  metadata_url: https://shop.bombas.com/.well-known/oauth-authorization-server
  identical_to: shopify-customer-account-oidc
  sources: [well-known/bombas-oauth-authorization-server.json]
protected_resource:
  rfc: RFC 9728
  metadata_url: https://shop.bombas.com/.well-known/oauth-protected-resource
  resource: https://shop.bombas.com
  authorization_servers: [https://shopify.com/authentication/11195850]
  bearer_methods_supported: [header]
  sources: [well-known/bombas-oauth-protected-resource.json]
not_found:
- {path: /.well-known/security.txt, host: shop.bombas.com, status: 404}
- {note: 'no api.bombas.com or developer.bombas.com host resolves in DNS'}
x-evidence:
  fetched: '2026-07-31'
  urls:
  - {url: 'https://shop.bombas.com/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://shop.bombas.com/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://shop.bombas.com/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://shop.bombas.com/api/ucp/mcp', http_status: 422, note: 'anonymous tools/list rejected'}