Fermat · Authentication Profile

Fermat Authentication

Authentication

Fermat declares 3 security scheme(s) across its OpenAPI definitions.

CompanyCommerceEcommercePersonalizationAnalyticsConversion Rate OptimizationAIMerchandisingMCPAgentic CommerceSession ReplayExperimentationAttribution
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

oauth2
· flows:
config.id apiKey
· in: body ()
apiKey
· in: header ()

Source

Authentication Profile

Raw ↑ 
generated: '2026-08-13'
method: probed
source: https://mcp.fermatcommerce.com/.well-known/oauth-authorization-server/mcp/fermat-mcp + https://help.fermatcommerce.com/en/articles/14431099-fermat-mcp-connect-your-commerce-data-to-ai-tools
note: FERMAT publishes no OpenAPI, so this profile is not derived from securitySchemes. It is read from
  the live RFC 8414 authorization-server metadata the MCP host serves anonymously, plus the provider help
  article.
schemes:
- id: fermat-mcp-oauth
  type: oauth2
  description: OAuth 2.1 authorization-code + PKCE against the FERMAT Platform MCP server. Users sign
    in with existing FERMAT platform credentials; the provider names Auth0 as the identity provider.
  applies_to: https://mcp.fermatcommerce.com/mcp/fermat-mcp
  flows:
    authorizationCode:
      issuer: https://mcp.fermatcommerce.com/mcp/fermat-mcp
      authorizationUrl: https://mcp.fermatcommerce.com/mcp/fermat-mcp/authorize
      tokenUrl: https://mcp.fermatcommerce.com/mcp/fermat-mcp/token
      registrationUrl: https://mcp.fermatcommerce.com/mcp/fermat-mcp/register
      revocationUrl: https://mcp.fermatcommerce.com/mcp/fermat-mcp/revoke
      grant_types:
      - authorization_code
      - refresh_token
      response_types:
      - code
      code_challenge_methods:
      - S256
      token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - none
      dynamic_client_registration: true
      authorization_response_iss_parameter_supported: true
      scopes: {}
  bearer_methods_supported:
  - header
  challenge: '401 with WWW-Authenticate: Bearer resource_metadata="https://mcp.fermatcommerce.com/.well-known/oauth-protected-resource/mcp/fermat-mcp"'
- id: fermat-pixel-id
  type: apiKey
  in: body
  name: config.id
  description: Browser pixel identification. The FERMAT Pixel v2 is initialized with a per-brand Pixel
    ID issued by a FERMAT representative; it is a public client-side identifier, not a secret credential.
  applies_to: https://e.clairedefermat.com, https://sr.clairedefermat.com
  source: https://help.fermatcommerce.com/en/articles/14280269-fermat-pixel-v2-installation-guide-direct-script-google-tag-manager
- id: mcp-pass-through-headers
  type: apiKey
  in: header
  description: The MCP install snippets require six caller-supplied credential headers (Mcp-Elmo-Api-Key,
    Mcp-Reddit-Client-Id/Secret/Username/Password, Mcp-Search-Api-Url), indicating the server proxies
    third-party systems using the caller's own credentials. Values are operator-supplied and unpublished.
  applies_to: https://mcp.fermatcommerce.com/mcp/fermat-mcp
onboarding:
  self_serve: false
  note: No public sign-up for API/MCP access. The provider FAQ states an active FERMAT account is required
    and directs prospects to their FERMAT account team; Pixel IDs are issued by a FERMAT representative.
scopes_published: false