Kite Hill Authentication

generated: '2026-08-23'
method: probed
source: https://kite-hill.com/.well-known/openid-configuration
docs: https://shopify.dev/docs/api/customer
description: >-
  Kite Hill publishes no OpenAPI, so this profile is built from live discovery documents and
  observed responses rather than derived securitySchemes. Five distinct auth postures were
  observed on 2026-08-23 — and notably, THREE of the machine surfaces answered with no
  credential at all.
summary:
  types: [none, openIdConnect, oauth2, agentProfile, http]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwt-bearer]
schemes:
- name: anonymous-storefront-graphql
  type: none
  surface: https://kite-hill.com/api/2026-04/graphql.json
  observed: >-
    Full GraphQL introspection succeeded with no X-Shopify-Storefront-Access-Token header,
    on five separate API versions (2026-04, 2026-01, 2025-07, 2025-01, unstable). Cost
    limiting is signalled via extensions.cost on every response rather than by an auth
    challenge.
  sources: [graphql/kite-hill-graphql.yml]
- name: anonymous-storefront-mcp
  type: none
  surface: https://kite-hill.com/api/mcp
  observed: >-
    An unauthenticated JSON-RPC tools/list returned HTTP 200 with five tools and their input
    schemas. No Authorization header, API key or Storefront token required.
  sources: [mcp/kite-hill-mcp.yml]
- name: anonymous-ucp-mcp-discovery
  type: none
  surface: https://kite-hill.com/api/ucp/mcp
  observed: >-
    An unauthenticated tools/list returned HTTP 200 with all thirteen commerce tools,
    including complete_checkout. Discovery of the commerce surface requires no credential.
  sources: [mcp/kite-hill-mcp.yml]
- name: ucp-agent-profile
  type: agentProfile
  surface: https://kite-hill.com/api/ucp/mcp
  mechanism: >-
    Every one of the thirteen UCP tools declares meta["ucp-agent"]["profile"] — a resolvable
    agent profile URI — as a REQUIRED input property. resources/list and prompts/list
    already fail without it, returning HTTP 422 and JSON-RPC error -32001 "UCP discovery
    failed" with code invalid_profile_url ("Unable to fetch agent profile: Missing profile
    uri").
  observed: >-
    Confirmed 2026-08-23: tools/list is open, but the agent-identity requirement is enforced
    on invocation and on the resource/prompt methods.
  spec: https://ucp.dev/2026-04-08/specification/overview/
  note: >-
    This is agent IDENTITY, not shopper authorization. Payment authorization is separate and,
    per the provider's own robots.txt, must be approved by a human at the time of purchase.
  sources: [mcp/kite-hill-ucp-mcp-tools.json, well-known/kite-hill-ucp.json]
- name: shopify-customer-accounts
  type: openIdConnect
  openIdConnectUrl: https://kite-hill.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/68089118898
  authorizationUrl: https://shopify.com/authentication/68089118898/oauth/authorize
  tokenUrl: https://shopify.com/authentication/68089118898/oauth/token
  end_session_endpoint: https://shopify.com/authentication/68089118898/logout
  jwks_uri: https://shopify.com/authentication/68089118898/.well-known/jwks.json
  grant_types: [authorization_code, refresh_token, 'urn:ietf:params:oauth:grant-type:jwt-bearer']
  response_types: [code]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  pkce: [S256]
  id_token_signing_alg: [RS256]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes: [openid, email, 'customer-account-api:full', 'customer-account-mcp-api:full']
  sources: [well-known/kite-hill-openid-configuration.json]
- name: shopify-customer-accounts-oauth2
  type: oauth2
  note: >-
    The same authorization server also publishes RFC 8414 metadata at
    /.well-known/oauth-authorization-server (byte-identical document), so the surface is
    usable as plain OAuth 2.0 as well as OIDC.
  sources: [well-known/kite-hill-oauth-authorization-server.json]
- name: storefront-customer-access-token
  type: http
  scheme: bearer
  surface: https://kite-hill.com/api/2026-04/graphql.json
  header: X-Shopify-Customer-Access-Token
  mechanism: >-
    The Storefront GraphQL schema itself carries a legacy shopper-token flow —
    customerAccessTokenCreate / customerAccessTokenRenew / customerAccessTokenDelete /
    customerAccessTokenCreateWithMultipass mutations, consumed by the customer query and the
    customer* mutations. Distinct from the OIDC customer-accounts flow above.
  sources: [graphql/kite-hill-storefront.graphql]
human_web:
  login: https://kite-hill.com/account/login
  register: https://kite-hill.com/account/register
  observed: >-
    Both 302 to https://shopify.com/68089118898/account — Shopify's hosted new customer
    accounts, i.e. the OIDC surface above rather than a store-local password form.
x-evidence:
- fetched: '2026-08-23'
  url: https://kite-hill.com/.well-known/openid-configuration
  http_status: 200
- fetched: '2026-08-23'
  url: https://kite-hill.com/api/2026-04/graphql.json
  http_status: 200
  note: anonymous introspection
- fetched: '2026-08-23'
  url: https://kite-hill.com/api/ucp/mcp
  http_status: 200
  note: anonymous tools/list; resources/list rejected 422 with -32001 invalid_profile_url
- fetched: '2026-08-23'
  url: https://kite-hill.com/account/login
  http_status: 302