Julep Beauty · Authentication Profile

Julep Beauty Authentication

Authentication

Julep's storefront has two distinct authentication postures. The public read-only catalog surface requires no credentials at all. The customer-account surface is a full OpenID Connect deployment (Shopify Customer Accounts) whose discovery document is served on Julep's own domain, with the interactive endpoints branded on account.julep.com.

Julep Beauty declares 3 security scheme(s) across its OpenAPI definitions.

CompanyBeautyCosmeticsSkincareRetailE-CommerceDirect to ConsumerShopifyAgentic CommerceUniversal Commerce Protocol
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

none
openIdConnect
other

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://www.julep.com/.well-known/openid-configuration
name: Julep authentication profile
description: >-
  Julep's storefront has two distinct authentication postures. The public read-only
  catalog surface requires no credentials at all. The customer-account surface is a
  full OpenID Connect deployment (Shopify Customer Accounts) whose discovery document
  is served on Julep's own domain, with the interactive endpoints branded on
  account.julep.com.
docs: https://www.julep.com/agents.md
schemes:
- id: none
  type: none
  applies_to: Public storefront JSON (products.json, collections/*/products.json, products/{handle}.json, cart.js, search)
  description: >-
    The provider explicitly documents this surface as "Read-Only Browsing (No
    Authentication Required)" in /agents.md. Verified anonymously on 2026-07-19.
  evidence: https://www.julep.com/agents.md
- id: customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.julep.com/.well-known/openid-configuration
  applies_to: Customer account (order history, profile, saved addresses)
  description: >-
    OpenID Connect authorization-code flow with PKCE. Discovery is also exposed as
    RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server
    (byte-identical at time of probe).
  issuer: https://shopify.com/authentication/2228781091
  endpoints:
    authorization: https://account.julep.com/authentication/oauth/authorize
    token: https://account.julep.com/authentication/oauth/token
    end_session: https://account.julep.com/authentication/logout
    jwks: https://account.julep.com/authentication/.well-known/jwks.json
  response_types_supported: [code]
  grant_types_supported:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [client_secret_basic]
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [public]
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes: scopes/julep-beauty-scopes.yml
  files:
  - well-known/julep-beauty-openid-configuration.json
  - well-known/julep-beauty-oauth-authorization-server.json
- id: ucp-agent-profile
  type: other
  applies_to: UCP/MCP commerce endpoint (POST /api/ucp/mcp)
  description: >-
    The MCP endpoint does not accept anonymous callers. Probing tools/list without an
    agent identity returns JSON-RPC error -32001 "UCP discovery failed" with code
    invalid_profile_url and the message "Unable to fetch agent profile: Missing profile
    uri" — i.e. the caller must present a resolvable UCP agent profile URI. Payment
    additionally requires explicit, contemporaneous buyer approval.
  evidence: https://www.julep.com/.well-known/ucp
  probed: '2026-07-19'
notes:
- Julep publishes no developer portal, no API keys, and no partner/server-to-server
  credential program of its own; all machine access is either anonymous storefront JSON
  or platform-mediated (Shopify Customer Accounts OIDC, UCP agent profiles).
- No RFC 9116 security.txt is published (404 on 2026-07-19).