Fnatic Authentication

generated: '2026-08-04'
method: probed
source: https://shop.fnatic.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Fnatic publishes no OpenAPI, so this profile is built from live discovery documents and
  observed responses rather than derived securitySchemes. Four distinct auth postures
  were observed across Fnatic hosts on 2026-08-04. Note that fnatic.com's own member
  accounts (Fnatic ID) are a first-party login surface with NO published discovery
  document — only the Shopify-hosted shop exposes machine-readable identity metadata.
summary:
  types: [none, openIdConnect, oauth2, other]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
schemes:
  - name: anonymous-storefront-graphql
    type: none
    surface: https://shop.fnatic.com/api/2026-04/graphql.json
    observed: >-
      Full GraphQL introspection succeeded with no X-Shopify-Storefront-Access-Token
      header (HTTP 200, 755,648 bytes). Cost/rate limiting is signalled via
      extensions.cost on every response rather than by rejecting anonymous callers.
    sources: [graphql/fnatic-graphql.yml]
  - name: shopify-customer-accounts
    type: openIdConnect
    openIdConnectUrl: https://shop.fnatic.com/.well-known/openid-configuration
    issuer: https://shopify.com/authentication/54359195821
    authorizationUrl: https://shopify.com/authentication/54359195821/oauth/authorize
    tokenUrl: https://shopify.com/authentication/54359195821/oauth/token
    end_session_endpoint: https://shopify.com/authentication/54359195821/logout
    jwks_uri: https://shopify.com/authentication/54359195821/.well-known/jwks.json
    grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
    response_types: [code]
    token_endpoint_auth_methods: [client_secret_basic]
    pkce: [S256]
    id_token_signing_alg: [RS256]
    claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
    scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
    sources: [well-known/fnatic-openid-configuration.json]
  - name: shopify-customer-accounts-oauth2
    type: oauth2
    note: >-
      The same authorization server also publishes RFC 8414 metadata at
      /.well-known/oauth-authorization-server (byte-identical document), and an RFC 9728
      protected-resource document at /.well-known/oauth-protected-resource declaring
      resource https://shop.fnatic.com with bearer_methods_supported [header]. The
      surface is therefore usable as plain OAuth 2.0 as well as OIDC.
    resource: https://shop.fnatic.com
    authorization_servers: ['https://shopify.com/authentication/54359195821']
    bearer_methods_supported: [header]
    sources:
      - well-known/fnatic-oauth-authorization-server.json
      - well-known/fnatic-oauth-protected-resource.json
  - name: storefront-customer-access-token
    type: other
    surface: https://shop.fnatic.com/api/2026-04/graphql.json
    observed: >-
      The legacy Storefront customer surface issues an opaque CustomerAccessToken via
      Mutation.customerAccessTokenCreate(input: CustomerAccessTokenCreateInput) and it is
      passed to QueryRoot.customer(customerAccessToken:) and every customer* mutation.
      Renewed with customerAccessTokenRenew, revoked with customerAccessTokenDelete.
      Multipass SSO is also present (customerAccessTokenCreateWithMultipass).
    sources: [graphql/fnatic-storefront.graphql]
  - name: ucp-agent-profile
    type: other
    surface: https://shop.fnatic.com/api/ucp/mcp
    observed: >-
      tools/list without an agent profile URI returns HTTP 422 with JSON-RPC -32001
      "UCP discovery failed" / invalid_profile_url. The UCP commerce surface therefore
      requires an agent to present a resolvable profile before any tool call, and Fnatic
      additionally requires contemporaneous buyer approval before complete_checkout.
    spec: https://ucp.dev/2026-04-08/specification/overview/
    sources: [well-known/fnatic-ucp.json, llms/fnatic-agents.md]
not_public:
  - name: fnatic-id
    surface: https://fnatic.com/account/login
    note: >-
      Fnatic's own member accounts ("Fnatic ID") on fnatic.com — register, login,
      change-password, connections, membership, wallet-connect. No OIDC/OAuth discovery
      document, no documented token endpoint, no developer program. Not a machine-readable
      auth surface.
  - name: id.fnatic.com
    surface: https://id.fnatic.com/
    note: >-
      Internal admin/identity application. Every request redirects to Google Workspace
      sign-in restricted to hd=fnatic.com (client_id 259306135017-…apps.googleusercontent.com,
      redirect_uri https://id.fnatic.com/nova/login-complete, scope "openid profile email").
      Staff-only; recorded for completeness, not an integrable surface.
platform:
  vendor: Shopify
  note: >-
    The identity provider is Shopify's, bound to Fnatic shop id 54359195821 and served
    from Fnatic's shop.fnatic.com domain. Unlike some Shopify merchants, Fnatic does not
    front the authorization endpoints on a fnatic.com vanity host — they resolve to
    shopify.com.
x-evidence:
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/.well-known/oauth-protected-resource
    http_status: 200
    content_type: application/json
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/api/2026-04/graphql.json
    http_status: 200
    result: anonymous introspection succeeded