Fox Factory Holding Authentication

generated: '2026-09-14'
method: probed
source: >-
  https://ridefox.com/.well-known/openid-configuration, https://ridefox.com/.well-known/oauth-authorization-server,
  https://ridefox.com/.well-known/oauth-protected-resource, and anonymous JSON-RPC probes of
  https://ridefox.com/api/ucp/mcp (all 2026-09-14)
provider: Fox Factory Holding
providerId: fox-factory-holding
description: >-
  Fox Factory Holding publishes no developer API keys and no partner API program. The authentication
  surface it actually serves belongs to its FOX storefront at ridefox.com: an OpenID Connect /
  OAuth 2.0 customer-account authorization server (operated by Shopify under the FOX shop id) and a
  UCP/MCP commerce endpoint that is anonymous for catalog and cart work and escalates to buyer
  approval plus a payment handler at checkout completion.
schemes:
  - id: anonymous-mcp
    type: none
    applies_to: https://ridefox.com/api/ucp/mcp
    description: >-
      tools/list and read-only catalog tools answered HTTP 200 with no credential on 2026-09-14. There
      is no API key, no registration and no developer account.
    evidence: {url: 'https://ridefox.com/api/ucp/mcp', method: POST, status: 200}
  - id: ucp-agent-profile
    type: agentProfile
    applies_to: https://ridefox.com/api/ucp/mcp
    location: 'meta["ucp-agent"].profile (JSON body, per-tool-call)'
    required: true
    description: >-
      Every tools/call must carry a UCP agent profile URI identifying the calling agent. This is an
      identity declaration, not a secret. Omitting it returns JSON-RPC error -32001
      (data.code invalid_profile_url) with HTTP 422.
    evidence: {url: 'https://ridefox.com/api/ucp/mcp', method: POST, status: 422, note: 'probe with empty arguments'}
  - id: shopify-customer-account-oidc
    type: openIdConnect
    applies_to: https://ridefox.com
    openIdConnectUrl: https://ridefox.com/.well-known/openid-configuration
    issuer: https://shopify.com/authentication/68121624800
    authorization_endpoint: https://shopify.com/authentication/68121624800/oauth/authorize
    token_endpoint: https://shopify.com/authentication/68121624800/oauth/token
    jwks_uri: https://shopify.com/authentication/68121624800/.well-known/jwks.json
    end_session_endpoint: https://shopify.com/authentication/68121624800/logout
    flows: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
    pkce: [S256]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
    id_token_signing_alg: [RS256]
    scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
    description: >-
      Buyer (customer account) identity for ridefox.com. The issuer is a Shopify-hosted authorization
      server scoped to the FOX shop id 68121624800; the discovery documents are served from Fox
      Factory's own host. The live storefront login at /customer_authentication/login redirects to
      this authorize endpoint with scope "openid email customer-account-api".
    evidence: {url: 'https://ridefox.com/.well-known/openid-configuration', status: 200}
  - id: oauth-protected-resource
    type: oauth2
    applies_to: https://ridefox.com
    description: RFC 9728 protected-resource metadata declaring ridefox.com as the resource and the Shopify authorization server.
    resource: https://ridefox.com
    authorization_servers: ['https://shopify.com/authentication/68121624800']
    bearer_methods_supported: [header]
    evidence: {url: 'https://ridefox.com/.well-known/oauth-protected-resource', status: 200}
payment_authentication:
  note: >-
    Checkout completion is authenticated by the buyer through a UCP payment handler, not by an API
    credential. Handlers declared in the merchant profile are Google Pay (com.google.pay), Shopify card
    (dev.shopify.card) and Shop Pay (dev.shopify.shop_pay). The provider's own /llms.txt states an agent
    must not complete payment without explicit, contemporaneous buyer approval.
  source: https://ridefox.com/.well-known/ucp
gaps:
  - No security.txt on any Fox Factory host.
  - No developer API keys, no partner API program, no first-party developer portal.
  - dealer.ridefox.com answers HTTP 401 — a credentialed dealer portal with no public documentation.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com