IM8 Health · Authentication Profile

Im8 Authentication

Authentication

Authentication profile for the IM8 Health storefront's buyer-scoped APIs, derived from the store's Shopify Customer Account OpenID Connect / OAuth 2.0 discovery documents. Read-only catalog browsing (product/collection JSON, search) requires no authentication; account- and purchase-scoped operations use OAuth 2.0 Authorization Code with PKCE.

IM8 Health declares 2 security scheme(s) across its OpenAPI definitions.

CompanyHealthWellnessSupplementsNutritionE-CommerceDirect to ConsumerAgentic CommerceShopifyUCPMCP
Methods: Schemes: 2 OAuth flows: API key in:

Security Schemes

shopify_customer_account_oauth2 oauth2
none none

Source

Authentication Profile

im8-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://im8health.com/.well-known/openid-configuration
type: Authentication
description: >-
  Authentication profile for the IM8 Health storefront's buyer-scoped APIs, derived
  from the store's Shopify Customer Account OpenID Connect / OAuth 2.0 discovery
  documents. Read-only catalog browsing (product/collection JSON, search) requires
  no authentication; account- and purchase-scoped operations use OAuth 2.0
  Authorization Code with PKCE.
schemes:
- name: shopify_customer_account_oauth2
  type: oauth2
  flow: authorization_code
  pkce: true
  pkce_methods:
  - S256
  issuer: https://shopify.com/authentication/63744606375
  authorization_endpoint: https://account.im8health.com/authentication/oauth/authorize
  token_endpoint: https://account.im8health.com/authentication/oauth/token
  end_session_endpoint: https://account.im8health.com/authentication/logout
  jwks_uri: https://account.im8health.com/authentication/.well-known/jwks.json
  token_endpoint_auth_methods:
  - client_secret_basic
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  id_token_signing_alg:
  - RS256
  scopes:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
- name: none
  type: none
  description: Read-only storefront browsing (collections, product JSON, search) needs no auth.
notes:
- OpenID Connect is supported (openid scope, id_token RS256, standard OIDC claims).
- customer-account-mcp-api:full scope authorizes MCP-driven access to customer account data.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/im8-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.