Leaftfoods Authentication

generated: '2026-07-19'
method: searched
source: https://www.leaftfoods.com/.well-known/openid-configuration
docs: https://www.leaftfoods.com/llms.txt
name: Leaft Foods Authentication Profile
description: The Leaft Foods storefront exposes three distinct access modes — fully anonymous read-only
  storefront JSON, an agent-facing UCP/MCP endpoint whose write operations gate on buyer approval rather
  than an API key, and OpenID Connect customer-account login served by Shopify's hosted authorization
  server. There is no self-serve developer API-key programme published by Leaft Foods itself.
schemes:
- id: anonymous_storefront
  type: none
  description: Read-only storefront data requires no authentication. Documented in the store's llms.txt as
    the path for agents that only need to read.
  endpoints:
  - GET /collections/all
  - GET /products/{handle}
  - GET /products/{handle}.json
  - GET /collections/{handle}
  - GET /collections/{handle}/products.json
  - GET /search?q={query}&type=product
  - GET /sitemap.xml
  - GET /cart.js
  verified:
    date: '2026-07-19'
    note: GET /products.json?limit=3 returned HTTP 200 with an empty products array — reachable and
      unauthenticated, catalog not currently published through that path.
- id: ucp_mcp
  type: openIdConnect
  flow: agent-profile
  description: The UCP MCP endpoint performs agent discovery rather than presenting a conventional API-key
    or bearer challenge. An unauthenticated tools/list is rejected with UCP error invalid_profile_url
    ("Missing profile uri"), meaning the calling agent must present a resolvable agent profile URI. Payment
    completion additionally requires contemporaneous human buyer approval, which is an authorization
    invariant of the protocol, not a credential.
  endpoint: https://www.leaftfoods.com/api/ucp/mcp
  specification: https://ucp.dev/2026-04-08/specification/overview/
  verified:
    date: '2026-07-19'
    status: 422
    error_code: invalid_profile_url
- id: customer_account_oidc
  type: openIdConnect
  description: OpenID Connect / OAuth 2.0 for Shopify customer accounts, discovered from the storefront
    host but issued by Shopify on behalf of shop 95682920744.
  issuer: https://shopify.com/authentication/95682920744
  openid_configuration: https://www.leaftfoods.com/.well-known/openid-configuration
  authorization_server_metadata: https://www.leaftfoods.com/.well-known/oauth-authorization-server
  authorization_endpoint: https://shopify.com/authentication/95682920744/oauth/authorize
  token_endpoint: https://shopify.com/authentication/95682920744/oauth/token
  end_session_endpoint: https://shopify.com/authentication/95682920744/logout
  jwks_uri: https://shopify.com/authentication/95682920744/.well-known/jwks.json
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  pkce:
    supported: true
    code_challenge_methods:
    - S256
  token_endpoint_auth_methods:
  - client_secret_basic
  id_token_signing_alg:
  - RS256
  subject_types:
  - public
  claims:
  - iss
  - sub
  - aud
  - exp
  - iat
  - nonce
  - sid
  - email
  - email_verified
  scopes:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
  policy_uri: https://www.shopify.com/legal/privacy
  tos_uri: https://www.shopify.com/legal/terms
notes:
- Authorization-code + PKCE (S256) is supported and is the correct public-client flow.
- client_secret_basic is the only token-endpoint auth method advertised; there is no client_secret_post or
  private_key_jwt.
- The scope customer-account-mcp-api:full indicates a customer-account MCP surface distinct from the
  storefront UCP MCP endpoint.