Omaze · Authentication Profile

Omaze Authentication

Authentication

Omaze publishes no API keys and no developer credentials. The only authentication surface it exposes is the Shopify Customer Accounts identity provider that sits behind its UK and German storefronts: a standards-compliant OpenID Connect 1.0 / OAuth 2.0 authorization server, discoverable anonymously, with PKCE required. This profile is derived entirely from the live discovery documents — no securityScheme was inferred from a spec, because there is no spec.

Omaze declares 2 security scheme(s) across its OpenAPI definitions.

CompanyCharityFundraisingNon-ProfitPrize DrawsSweepstakesE-CommerceAgentic CommerceUniversal Commerce ProtocolMCPShopifyUnited KingdomGermany

Methods: Schemes: 2 OAuth flows: API key in:

Security Schemes

openIdConnect

Source

Authentication Profile

generated: '2026-08-02'
method: probed
source: >-
  https://omaze.co.uk/.well-known/openid-configuration,
  https://omaze.co.uk/.well-known/oauth-authorization-server,
  https://omaze.co.uk/.well-known/oauth-protected-resource,
  https://omaze.de/.well-known/openid-configuration — all fetched 2026-08-02.
description: >-
  Omaze publishes no API keys and no developer credentials. The only
  authentication surface it exposes is the Shopify Customer Accounts identity
  provider that sits behind its UK and German storefronts: a standards-compliant
  OpenID Connect 1.0 / OAuth 2.0 authorization server, discoverable anonymously,
  with PKCE required. This profile is derived entirely from the live discovery
  documents — no securityScheme was inferred from a spec, because there is no
  spec.
schemes:
  - id: shopify-customer-accounts-uk
    type: openIdConnect
    market: United Kingdom
    issuer: https://shopify.com/authentication/27583905878
    openid_configuration: https://omaze.co.uk/.well-known/openid-configuration
    file: ../well-known/omaze-uk-openid-configuration.json
    endpoints:
      authorization: https://accounts.omaze.co.uk/authentication/oauth/authorize
      token: https://accounts.omaze.co.uk/authentication/oauth/token
      end_session: https://accounts.omaze.co.uk/authentication/logout
      jwks: https://accounts.omaze.co.uk/authentication/.well-known/jwks.json
    grant_types:
      - authorization_code
      - refresh_token
      - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
    response_types:
      - code
    token_endpoint_auth_methods:
      - client_secret_basic
    pkce:
      required: true
      code_challenge_methods:
        - S256
    id_token_signing_alg:
      - RS256
    subject_types:
      - public
    claims:
      - iss
      - sub
      - aud
      - exp
      - iat
      - nonce
      - sid
      - email
      - email_verified
    scopes: ../scopes/omaze-scopes.yml
  - id: shopify-customer-accounts-de
    type: openIdConnect
    market: Germany
    issuer: https://shopify.com/authentication/69889196213
    openid_configuration: https://omaze.de/.well-known/openid-configuration
    file: ../well-known/omaze-de-openid-configuration.json
    endpoints:
      authorization: https://accounts.omaze.de/authentication/oauth/authorize
    note: >-
      Same Shopify Customer Accounts profile as the UK store, distinct issuer and
      account host. Scope set is identical.
protected_resource:
  spec: RFC 9728 (OAuth 2.0 Protected Resource Metadata)
  url: https://omaze.co.uk/.well-known/oauth-protected-resource
  file: ../well-known/omaze-uk-oauth-protected-resource.json
  resource: https://omaze.co.uk
  authorization_servers:
    - https://accounts.omaze.co.uk
    - https://shopify.com/authentication/27583905878
  bearer_methods_supported:
    - header
anonymous_surfaces:
  - surface: UCP Shopping MCP endpoint (https://omaze.co.uk/api/ucp/mcp)
    auth: >-
      No bearer token is required to reach the endpoint, but the server refuses
      to negotiate without a resolvable UCP agent profile URI from the calling
      agent (observed: JSON-RPC -32001 / invalid_profile_url, HTTP 422). Payment
      completion additionally requires explicit buyer approval.
  - surface: Storefront product/collection JSON (/products.json, /collections/{handle}/products.json)
    auth: None. Read-only, anonymous, public.
not_published:
  api_keys: No developer API keys, no key-issuance flow, no developer portal.
  mtls: Not advertised.
  http_basic: Not advertised.
  service_accounts: None.
docs: https://omaze.co.uk/agents.md

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/omaze-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.