Ryse Authentication

generated: '2026-08-26'
method: probed
source: >-
  https://account.helloryse.com/.well-known/oauth-authorization-server,
  https://account.helloryse.com/.well-known/oauth-protected-resource,
  https://www.helloryse.com/.well-known/openid-configuration, plus live anonymous and unauthenticated
  JSON-RPC probes of all three RYSE MCP endpoints on 2026-08-26
summary: >-
  RYSE publishes no API keys and no developer credentials. Its two commerce MCP surfaces on
  www.helloryse.com are ANONYMOUS for discovery and for read/cart/checkout construction; the only
  authenticated surface is the customer-account MCP on account.helloryse.com, which is protected by
  RYSE's own OAuth 2.0 / OpenID Connect authorization server (Shopify-operated, merchant-scoped to
  shop 51479806112) and advertises itself per RFC 9728.
schemes:
- id: anonymous
  type: none
  applies_to:
  - https://www.helloryse.com/api/ucp/mcp
  - https://www.helloryse.com/api/mcp
  description: >-
    tools/list, initialize, prompts/list and resources/list require no credential of any kind. Both
    endpoints returned HTTP 200 to an unauthenticated POST.
  evidence:
    probe: 'POST {"jsonrpc":"2.0","id":1,"method":"tools/list"}'
    http_status: 200
    date: '2026-08-26'
- id: ucp-agent-profile
  type: agent-identity
  applies_to:
  - https://www.helloryse.com/api/ucp/mcp
  description: >-
    Not authentication in the credential sense, but the UCP server's admission control for
    tools/call: every request must carry meta["ucp-agent"].profile, a fetchable URI identifying the
    calling agent. The server dereferences it; a missing or unfetchable profile is rejected before
    the tool runs. This is the identity RYSE's commerce surface actually checks.
  required: true
  parameter: meta.ucp-agent.profile
  parameter_format: uri
  evidence:
    probe: 'POST tools/call and prompts/list without meta["ucp-agent"].profile'
    http_status: 422
    body: >-
      {"error":{"code":-32001,"message":"UCP discovery failed",
      "data":{"code":"invalid_profile_url","content":"Unable to fetch agent profile: Missing profile uri"}}}
    date: '2026-08-26'
- id: customer-oauth
  type: oauth2
  applies_to:
  - https://account.helloryse.com/customer/api/mcp
  description: >-
    The customer-account MCP acts on a logged-in RYSE customer. tools/list is anonymous, but every
    tools/call requires a bearer access token issued by RYSE's customer authorization server.
  bearer_methods_supported:
  - header
  flows:
    authorization_code:
      authorization_url: https://account.helloryse.com/authentication/oauth/authorize
      token_url: https://account.helloryse.com/authentication/oauth/token
      pkce: required
      code_challenge_methods_supported:
      - S256
  issuer: https://shopify.com/authentication/51479806112
  jwks_uri: https://account.helloryse.com/authentication/.well-known/jwks.json
  end_session_endpoint: https://account.helloryse.com/authentication/logout
  grant_types_supported:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  response_types_supported:
  - code
  id_token_signing_alg_values_supported:
  - RS256
  scopes_file: ../scopes/ryse-scopes.yml
  evidence:
    probe: 'POST tools/call get_most_recent_order_status with no Authorization header'
    http_status: 401
    body: '{"errors":[{"message":"Unauthorized"}]}'
    www_authenticate: https://account.helloryse.com/authentication/.well-known/openid-configuration
    date: '2026-08-26'
openid_connect:
  supported: true
  discovery_document: https://account.helloryse.com/.well-known/openid-configuration
  file: ../well-known/ryse-openid-configuration.json
  subject_types_supported:
  - public
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
protected_resource_metadata:
  supported: true
  standard: RFC 9728 OAuth 2.0 Protected Resource Metadata
  document: https://account.helloryse.com/.well-known/oauth-protected-resource
  file: ../well-known/ryse-oauth-protected-resource.json
  resource: https://account.helloryse.com
  authorization_servers:
  - https://account.helloryse.com
  - https://shopify.com/authentication/51479806112
notes:
- >-
  No API key, no client credentials grant, and no machine-to-machine credential is published anywhere
  on RYSE's own surface. An agent cannot obtain a RYSE-issued key.
- >-
  RYSE's robots.txt and agents.md impose an out-of-band authorization rule that no credential
  satisfies: "Checkouts are for humans. Do NOT complete checkout, payment, or order placement
  automatically ... without an explicit, contemporaneous human approval step." Treat human approval
  as a required authorization factor on complete_checkout.
- >-
  The device/hardware side of RYSE (SmartShade, SmartCurtain, SmartBridge) has no published
  authentication surface at all — there is no cloud or local device API documented for developers.