Oishii Authentication

generated: '2026-08-04'
method: searched
source: https://oishii.com/.well-known/openid-configuration
docs: https://oishii.com/agents.md
note: >-
  Oishii publishes no OpenAPI, so this profile is built from the live discovery documents served on the
  oishii.com host plus the observed behaviour of the two MCP endpoints. Identity is delegated to the
  Shopify customer-account issuer; the anonymous storefront read surface requires no credentials at all.
summary:
  types:
  - none
  - oauth2
  - openIdConnect
  oauth2_flows:
  - authorizationCode
  - refreshToken
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  bearer_methods:
  - header
  pkce: S256
schemes:
- name: anonymous-storefront
  type: none
  description: >-
    The storefront MCP server (POST https://oishii.com/api/mcp) and the storefront JSON feeds
    (/products.json, /collections/{handle}/products.json, /products/{handle}.json) answer without any
    credential. tools/list, search_catalog, get_product_details and search_shop_policies_and_faqs were all
    reachable anonymously.
  sources:
  - https://oishii.com/api/mcp
  - https://oishii.com/agents.md
- name: ucp-agent-profile
  type: agent-identity
  description: >-
    The UCP commerce endpoint (POST https://oishii.com/api/ucp/mcp) requires the calling agent to present
    a profile URI (meta.ucp-agent.profile). Without it the server returns HTTP 422 with JSON-RPC error
    -32001 invalid_profile_url. This is an agent-identity gate, not an end-user credential.
  sources:
  - https://oishii.com/api/ucp/mcp
  - https://oishii.com/.well-known/ucp
- name: shopify-customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://oishii.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/26346881082
  authorization_endpoint: https://shopify.com/authentication/26346881082/oauth/authorize
  token_endpoint: https://shopify.com/authentication/26346881082/oauth/token
  end_session_endpoint: https://shopify.com/authentication/26346881082/logout
  jwks_uri: https://shopify.com/authentication/26346881082/.well-known/jwks.json
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  response_types_supported:
  - code
  id_token_signing_alg_values_supported:
  - RS256
  code_challenge_methods_supported:
  - S256
  claims_supported:
  - iss
  - sub
  - aud
  - exp
  - iat
  - nonce
  - sid
  - email
  - email_verified
  scopes:
  - openid
  - email
  - customer-account-api:full
  - customer-account-mcp-api:full
  sources:
  - well-known/oishii-openid-configuration.json
  - well-known/oishii-oauth-authorization-server.json
- name: shopify-protected-resource
  type: oauth2
  description: >-
    RFC 9728 protected-resource metadata declares https://oishii.com as an OAuth-protected resource whose
    authorization server is the Shopify customer-account issuer, with bearer tokens carried in the
    Authorization header.
  resource: https://oishii.com
  authorization_servers:
  - https://shopify.com/authentication/26346881082
  bearer_methods_supported:
  - header
  sources:
  - well-known/oishii-oauth-protected-resource.json
x-evidence:
  fetched: '2026-08-04'
  probes:
  - url: https://oishii.com/.well-known/openid-configuration
    http_status: 200
  - url: https://oishii.com/.well-known/oauth-protected-resource
    http_status: 200
  - url: https://oishii.com/api/mcp
    http_status: 200
  - url: https://oishii.com/api/ucp/mcp
    http_status: 422