Hint Authentication

generated: '2026-08-22'
method: probed
source: >-
  https://www.drinkhint.com/.well-known/openid-configuration,
  https://www.drinkhint.com/.well-known/oauth-protected-resource,
  and an anonymous JSON-RPC tools/list against https://www.drinkhint.com/api/ucp/mcp
summary: >-
  Two distinct auth postures. The agentic commerce surface (UCP/MCP) is ANONYMOUS — catalog, cart
  and checkout tools answered without any credential; the only required call context is a
  meta.ucp-agent.profile URI, which identifies the agent rather than authenticating it, and payment
  is gated on contemporaneous human approval rather than on a token. Buyer accounts use Shopify
  Customer Accounts, an OpenID Connect provider with authorization code + PKCE.
schemes:
- id: mcp_anonymous
  type: none
  applies_to: https://www.drinkhint.com/api/ucp/mcp
  description: >-
    tools/list and the catalog tools answer unauthenticated. Rejection observed on 2026-08-22 was
    for a MISSING meta.ucp-agent.profile (JSON-RPC -32001 invalid_profile_url, HTTP 422), not for a
    missing credential.
  evidence: anonymous POST tools/list returned HTTP 200 with 13 tools
- id: shopify_customer_accounts_oidc
  type: openIdConnect
  openIdConnectUrl: https://www.drinkhint.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/1430159418
  authorization_endpoint: https://shopify.com/authentication/1430159418/oauth/authorize
  token_endpoint: https://shopify.com/authentication/1430159418/oauth/token
  jwks_uri: https://shopify.com/authentication/1430159418/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/1430159418/logout
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  pkce:
    supported: true
    code_challenge_methods:
    - S256
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg:
  - RS256
  bearer_methods_supported:
  - header
  protected_resource: https://www.drinkhint.com
  applies_to: storefront customer account (login, orders, subscriptions)
  human_entry_point: https://www.drinkhint.com/account/login
notes:
- No API keys, no developer application registration, and no partner program are published by Hint.
- The OIDC provider is Shopify's, scoped to this merchant's shop id (1430159418); Hint does not run
  its own identity provider.