Dolls Kill Authentication

generated: '2026-08-12'
method: searched
source: https://www.dollskill.com/.well-known/openid-configuration
docs: https://www.dollskill.com/agents.md
note: 'Dolls Kill publishes no OpenAPI, so this profile was not derived from securitySchemes.
  It was read from the live OpenID Connect / OAuth discovery documents the storefront
  serves, from the RFC 9728 protected-resource metadata, and from probing each API
  surface anonymously to observe what it actually requires.'
summary:
  types: [none, oauth2, openIdConnect, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  anonymous_surfaces: 4
  gated_surfaces: 2
schemes:
- name: Anonymous
  type: none
  applies_to:
  - https://www.dollskill.com/api/ucp/mcp (initialize, tools/list)
  - https://www.dollskill.com/api/{version}/graphql.json (introspection and public
    storefront reads)
  - https://www.dollskill.com/products.json and the /collections/*/products.json family
  - https://www.dollskill.com/.well-known/* discovery documents
  note: 'No credential of any kind is required to enumerate the MCP tool set with its
    full input schemas, to introspect the Storefront GraphQL schema, or to read product
    JSON. This is the widest anonymous machine-readable surface on the property.'
- name: UCP agent profile
  type: apiKey
  in: body
  parameter: meta.ucp-agent.profile
  format: uri
  applies_to:
  - https://www.dollskill.com/api/ucp/mcp (tools/call, prompts/list, resources/list)
  note: 'Not a bearer credential — an HTTP-resolvable agent profile URI the merchant
    fetches to identify the calling agent. Omitting it returns JSON-RPC -32001 with
    data.code invalid_profile_url; supplying an unreachable URI returns data.code
    profile_unreachable. Observed on live probes 2026-08-12.'
- name: Shopify Storefront access token
  type: apiKey
  in: header
  parameter: X-Shopify-Storefront-Access-Token
  applies_to:
  - https://www.dollskill.com/api/{version}/graphql.json
  required: false
  note: 'The Storefront API conventionally takes this header, but the Dolls Kill endpoint
    answered a full introspection query with no token present. Recorded as optional
    because that is what was observed, not because the docs say so.'
- name: Customer Account OAuth 2.0 / OpenID Connect
  type: oauth2
  openid_connect_url: https://www.dollskill.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/63463358721
  flows:
  - flow: authorizationCode
    authorizationUrl: https://account.dollskill.com/authentication/oauth/authorize
    tokenUrl: https://account.dollskill.com/authentication/oauth/token
    scopes:
      openid: OpenID Connect authentication
      email: Access to the customer's email address
      customer-account-api:full: Full access to the Customer Account API
      customer-account-mcp-api:full: Full access to the Customer Account MCP API
  pkce:
    supported: true
    code_challenge_methods: [S256]
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  token_endpoint_auth_methods: [client_secret_basic]
  id_token_signing_alg: [RS256]
  jwks_uri: https://account.dollskill.com/authentication/.well-known/jwks.json
  end_session_endpoint: https://account.dollskill.com/authentication/logout
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  applies_to:
  - https://account.dollskill.com
  - Customer Account API and Customer Account MCP API (order history, addresses)
protected_resource:
  source: https://www.dollskill.com/.well-known/oauth-protected-resource
  resource: https://www.dollskill.com
  authorization_servers:
  - https://account.dollskill.com
  - https://shopify.com/authentication/63463358721
  bearer_methods_supported: [header]
human_in_the_loop:
  required_for: [complete_checkout]
  statement: 'Checkouts are for humans. Do NOT complete checkout, payment, or order
    placement automatically — no scripted form fills, browser automation, or end-to-end
    agent flows that finalize payment without an explicit, contemporaneous human approval
    step.'
  published_at:
  - https://www.dollskill.com/robots.txt
  - https://www.dollskill.com/agents.md
  - https://www.dollskill.com/llms.txt
x-evidence:
- url: https://www.dollskill.com/.well-known/openid-configuration
  status: 200
- url: https://www.dollskill.com/.well-known/oauth-protected-resource
  status: 200
- url: https://www.dollskill.com/api/ucp/mcp
  status: 200
  note: tools/list answered anonymously
- url: https://www.dollskill.com/api/2026-04/graphql.json
  status: 200
  note: full introspection answered with no access token