Julep Beauty · Authentication Profile

Julep Beauty Authentication

Authentication

Julep's storefront has two distinct authentication postures. The public read-only catalog surface requires no credentials at all. The customer-account surface is a full OpenID Connect deployment (Shopify Customer Accounts) whose discovery document is served on Julep's own domain, with the interactive endpoints branded on account.julep.com.

Julep Beauty declares 3 security scheme(s) across its OpenAPI definitions.

CompanyBeautyCosmeticsSkincareRetailE-CommerceDirect to ConsumerShopifyAgentic CommerceUniversal Commerce Protocol
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

none
openIdConnect
other

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://www.julep.com/.well-known/openid-configuration
name: Julep authentication profile
description: >-
  Julep's storefront has two distinct authentication postures. The public read-only
  catalog surface requires no credentials at all. The customer-account surface is a
  full OpenID Connect deployment (Shopify Customer Accounts) whose discovery document
  is served on Julep's own domain, with the interactive endpoints branded on
  account.julep.com.
docs: https://www.julep.com/agents.md
schemes:
- id: none
  type: none
  applies_to: Public storefront JSON (products.json, collections/*/products.json, products/{handle}.json, cart.js, search)
  description: >-
    The provider explicitly documents this surface as "Read-Only Browsing (No
    Authentication Required)" in /agents.md. Verified anonymously on 2026-07-19.
  evidence: https://www.julep.com/agents.md
- id: customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.julep.com/.well-known/openid-configuration
  applies_to: Customer account (order history, profile, saved addresses)
  description: >-
    OpenID Connect authorization-code flow with PKCE. Discovery is also exposed as
    RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server
    (byte-identical at time of probe).
  issuer: https://shopify.com/authentication/2228781091
  endpoints:
    authorization: https://account.julep.com/authentication/oauth/authorize
    token: https://account.julep.com/authentication/oauth/token
    end_session: https://account.julep.com/authentication/logout
    jwks: https://account.julep.com/authentication/.well-known/jwks.json
  response_types_supported: [code]
  grant_types_supported:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [client_secret_basic]
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [public]
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes: scopes/julep-beauty-scopes.yml
  files:
  - well-known/julep-beauty-openid-configuration.json
  - well-known/julep-beauty-oauth-authorization-server.json
- id: ucp-agent-profile
  type: other
  applies_to: UCP/MCP commerce endpoint (POST /api/ucp/mcp)
  description: >-
    The MCP endpoint does not accept anonymous callers. Probing tools/list without an
    agent identity returns JSON-RPC error -32001 "UCP discovery failed" with code
    invalid_profile_url and the message "Unable to fetch agent profile: Missing profile
    uri" — i.e. the caller must present a resolvable UCP agent profile URI. Payment
    additionally requires explicit, contemporaneous buyer approval.
  evidence: https://www.julep.com/.well-known/ucp
  probed: '2026-07-19'
notes:
- Julep publishes no developer portal, no API keys, and no partner/server-to-server
  credential program of its own; all machine access is either anonymous storefront JSON
  or platform-mediated (Shopify Customer Accounts OIDC, UCP agent profiles).
- No RFC 9116 security.txt is published (404 on 2026-07-19).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/julep-beauty-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.