Kate Farms · Authentication Profile

Kate Farms Authentication

Authentication

Kate Farms secures its APIs with openIdConnect, oauth2, apiKey, and none across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyNutritionMedical NutritionHealthFood and BeverageConsumer Packaged GoodsE-CommerceAgentic CommerceRetailShopifyGraphQL
Methods: openIdConnect, oauth2, apiKey, none Schemes: 5 OAuth flows: authorizationCode API key in: header

Security Schemes

AnonymousStorefront none
StorefrontAccessToken apiKey
· in: header ()
CustomerAccountsOIDC openIdConnect
CustomerAccessToken apiKey
· in: header ()
UCPAgentProfile oauth2

Source

Authentication Profile

kate-farms-authentication.yml Raw ↑ 
generated: '2026-08-04'
method: probed
source: https://shop.katefarms.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
summary:
  types:
  - openIdConnect
  - oauth2
  - apiKey
  - none
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  bearer_methods_supported:
  - header
schemes:
- name: AnonymousStorefront
  type: none
  description: The Storefront GraphQL endpoint at https://shop.katefarms.com/api/2026-01/graphql.json
    answered queries AND a full introspection query with no credential of any kind
    on 2026-08-04. Public catalog, collection, search, blog, page and metaobject reads
    require no authentication.
  sources:
  - graphql/kate-farms-storefront.graphql
  verified: '2026-08-04'
- name: StorefrontAccessToken
  type: apiKey
  in: header
  parameter_name: X-Shopify-Storefront-Access-Token
  description: Shopify's documented public storefront credential for the Storefront
    API. Not required for the anonymous reads observed here, but it is the documented
    scheme for the surface and is the credential a first-party client uses.
  sources:
  - https://shopify.dev/docs/api/storefront
  x-note: Documented by the platform (Shopify), not by Kate Farms.
- name: CustomerAccountsOIDC
  type: openIdConnect
  openIdConnectUrl: https://shop.katefarms.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/2056802
  authorization_endpoint: https://shopify.com/authentication/2056802/oauth/authorize
  token_endpoint: https://shopify.com/authentication/2056802/oauth/token
  end_session_endpoint: https://shopify.com/authentication/2056802/logout
  jwks_uri: https://shopify.com/authentication/2056802/.well-known/jwks.json
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  - refresh_token
  - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  code_challenge_methods_supported:
  - S256
  id_token_signing_alg_values_supported:
  - RS256
  subject_types_supported:
  - public
  claims_supported:
  - iss
  - sub
  - aud
  - exp
  - iat
  - nonce
  - sid
  - email
  - email_verified
  description: Kate Farms' shopper identity. Customer Accounts sign-in is an OIDC
    authorization-code flow with mandatory PKCE (S256) against a per-shop Shopify issuer.
    Scopes are catalogued in scopes/kate-farms-scopes.yml.
  sources:
  - well-known/kate-farms-openid-configuration.json
  verified: '2026-08-04'
- name: CustomerAccessToken
  type: apiKey
  in: header
  parameter_name: 'customerAccessToken (GraphQL argument)'
  description: The Storefront schema also carries a legacy customer access token model
    — customerAccessTokenCreate / Renew / Delete mutations mint a CustomerAccessToken
    passed as a GraphQL argument to customer-scoped queries and mutations. Present
    in the live schema alongside the newer OIDC Customer Accounts flow.
  sources:
  - graphql/kate-farms-storefront.graphql
  verified: '2026-08-04'
- name: UCPAgentProfile
  type: oauth2
  description: The UCP MCP endpoint at https://shop.katefarms.com/api/ucp/mcp requires
    a resolvable agent profile URI before it will answer tools/list. Anonymous calls
    (with and without MCP-Protocol-Version / UCP-Version headers) returned JSON-RPC
    error -32001 "UCP discovery failed" with data.code invalid_profile_url. Bearer
    tokens for the protected resource https://shop.katefarms.com are issued by the
    authorization server declared at /.well-known/oauth-protected-resource, presented
    in the Authorization header.
  authorization_server: https://shopify.com/authentication/2056802
  bearer_methods_supported:
  - header
  gated: true
  sources:
  - well-known/kate-farms-oauth-protected-resource.json
  - well-known/kate-farms-ucp.json
  verified: '2026-08-04'
x-evidence:
- url: https://shop.katefarms.com/.well-known/openid-configuration
  http_status: 200
- url: https://shop.katefarms.com/.well-known/oauth-protected-resource
  http_status: 200
- url: https://shop.katefarms.com/api/2026-01/graphql.json
  http_status: 200
  note: anonymous introspection succeeded, 424 types returned
- url: https://shop.katefarms.com/api/ucp/mcp
  http_status: 422
  note: 'JSON-RPC -32001 invalid_profile_url: "Unable to fetch agent profile: Missing
    profile uri"'