Carmd Authentication

generated: '2026-08-27'
method: probed
source: >-
  live probes 2026-08-27 — https://carmd.com/.well-known/openid-configuration,
  https://carmd.com/api/ucp/mcp, https://carmd.com/api/2026-04/graphql.json,
  https://carmd.com/llms.txt; plus https://api.carmd.com/member/docs (unreachable)
provider: CarMD
providerId: carmd
description: >-
  Authentication profile for every CarMD surface that could actually be reached. There is no OpenAPI to
  derive securitySchemes from, so every entry below was established by calling the surface. The CarMD
  Vehicle API's own auth model could not be verified: its host refused connections.
surfaces:
  - name: CarMD UCP Commerce MCP
    endpoint: https://carmd.com/api/ucp/mcp
    scheme_type: none
    scheme: anonymous
    verified: probed
    evidence: >-
      POST tools/list and POST initialize both returned HTTP 200 with no Authorization header and no API
      key. No 401/403 challenge was issued.
    required_context:
      - field: meta.ucp-agent.profile
        in: body
        required: true
        description: >-
          Every tool call must carry a UCP agent profile URI. Omitting it returns HTTP 422 with JSON-RPC
          error -32001 "UCP discovery failed" (data.code invalid_profile_url). This is agent identity
          discovery, not a credential.
    payment_authorization: >-
      Payment on complete_checkout requires contemporaneous human buyer approval; the provider's llms.txt
      states agents must not complete payment without explicit buyer consent.
  - name: CarMD Storefront GraphQL
    endpoint: https://carmd.com/api/2026-04/graphql.json
    scheme_type: none
    scheme: anonymous
    verified: probed
    evidence: >-
      Anonymous POST introspection returned the full 424-type schema, and an anonymous data query returned
      shop.name "CarMD" and live product records — both HTTP 200 with no storefront access token supplied.
    note: >-
      Customer-scoped fields (customer, order history) still require a customer access token minted through
      customerAccessTokenCreate or the OIDC flow below.
  - name: CarMD customer accounts (OpenID Connect)
    endpoint: https://shopify.com/authentication/93440671876
    discovery: https://carmd.com/.well-known/openid-configuration
    scheme_type: openIdConnect
    scheme: 'OAuth 2.0 authorization code + PKCE (S256)'
    verified: probed
    flows:
      authorization_code:
        authorization_url: https://shopify.com/authentication/93440671876/oauth/authorize
        token_url: https://shopify.com/authentication/93440671876/oauth/token
        refresh_url: https://shopify.com/authentication/93440671876/oauth/token
        scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
    client_auth: [client_secret_basic, client_secret_post]
    token_format: 'JWT (RS256 id_token)'
    scopes_artifact: scopes/carmd-scopes.yml
  - name: CarMD Vehicle API (CarScan)
    endpoint: https://api.carmd.com/
    human_url: https://api.carmd.com/member/
    scheme_type: unknown
    scheme: unverified
    verified: none
    evidence: >-
      Host DNS-resolves to 54.86.119.234 but TCP 80 and 443 are closed. curl returned "Connection timed
      out after 8001 milliseconds" and an independent fetcher returned ECONNREFUSED on 54.86.119.234:443.
      The developer documentation at https://api.carmd.com/member/docs, still linked from the carmd.com
      footer, could not be retrieved; archive.org was also unreachable from this run.
    note: >-
      Search-engine indexed text of that documentation page describes registration issuing two credentials,
      with an authorization key that must be sent in a request header rather than as a query parameter.
      That is second-hand and unverified, so it is recorded here as a lead, not as a documented scheme.
findings:
  api_key: unverified
  oauth2: true
  openid_connect: true
  mutual_tls: false
  anonymous_surfaces: 2
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com