Bulletproof Authentication

generated: '2026-08-08'
method: probed
source:
- https://shop.bulletproof.com/.well-known/openid-configuration
- https://shop.bulletproof.com/.well-known/oauth-authorization-server
- https://shop.bulletproof.com/.well-known/oauth-protected-resource
- live probes of the Storefront GraphQL and UCP MCP endpoints
note: >-
  Bulletproof publishes no OpenAPI, so nothing here is derived from securitySchemes.
  Every scheme below was observed live on 2026-08-08 — three of the four surfaces
  answered anonymously, which is itself the finding.
summary:
  types: [none, oauth2, openIdConnect, bearer]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  anonymous_surfaces: 3
  gated_surfaces: 2
schemes:
- name: storefront-graphql-anonymous
  type: none
  applies_to: https://shop.bulletproof.com/api/{version}/graphql.json
  observed: >-
    Introspection and data queries (shop, products, cart) returned HTTP 200 with no
    X-Shopify-Storefront-Access-Token header and no cookie. access-control-allow-origin
    is "*". Cost is reported per request via shopify-complexity-score headers and the
    extensions.cost field.
  evidence:
    http_status: 200
    url: https://shop.bulletproof.com/api/2026-01/graphql.json
- name: storefront-json-anonymous
  type: none
  applies_to: https://shop.bulletproof.com/products.json, /collections.json, /products/{handle}.json
  observed: HTTP 200 unauthenticated; documented as the read-only agent surface in agents.md.
  evidence:
    http_status: 200
    url: https://shop.bulletproof.com/products.json
- name: wordpress-rest-anonymous
  type: none
  applies_to: https://www.bulletproof.com/wp-json/
  observed: >-
    The route index reports an empty "authentication" array — no authentication scheme
    is advertised for the public read routes across 16 namespaces / 384 routes.
  evidence:
    http_status: 200
    url: https://www.bulletproof.com/wp-json/
- name: ucp-agent-profile
  type: bearer
  scheme: jwt
  applies_to: https://shop.bulletproof.com/api/ucp/mcp
  observed: >-
    tools/list and initialize answer anonymously. Every tools/call requires a resolvable
    meta["ucp-agent"].profile URI; without one the server returns JSON-RPC -32001
    "UCP discovery failed". Order and checkout tools additionally return JSON-RPC -32000
    "AuthenticationRequired — a valid JWT is required".
  docs: https://shopify.dev/docs/agents/get-started/authentication
  evidence:
    http_status: 403
    url: https://shop.bulletproof.com/api/ucp/mcp
- name: customer-accounts-oidc
  type: openIdConnect
  openIdConnectUrl: https://shop.bulletproof.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/434700319
  applies_to: https://account.bulletproof.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://account.bulletproof.com/authentication/oauth/authorize
    tokenUrl: https://account.bulletproof.com/authentication/oauth/token
    scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  jwks_uri: https://account.bulletproof.com/authentication/.well-known/jwks.json
  end_session_endpoint: https://account.bulletproof.com/authentication/logout
  token_endpoint_auth_methods_supported: [client_secret_basic]
  grant_types_supported: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  code_challenge_methods_supported: [S256]
  id_token_signing_alg_values_supported: [RS256]
  response_types_supported: [code]
  subject_types_supported: [public]
  evidence:
    http_status: 200
    url: https://shop.bulletproof.com/.well-known/openid-configuration
- name: customer-accounts-oauth2
  type: oauth2
  applies_to: https://account.bulletproof.com
  metadata: RFC 8414 authorization server metadata, identical payload to the OIDC document
  protected_resource_metadata: RFC 9728 at /.well-known/oauth-protected-resource on shop., account. and myshopify hosts
  evidence:
    http_status: 200
    url: https://shop.bulletproof.com/.well-known/oauth-authorization-server
gaps:
- The provider publishes no first-party authentication documentation; the only auth guidance
  reachable from a Bulletproof host is the shopify.dev link embedded in an MCP error message.
- No /.well-known/security.txt on any host.