Super Coffee · Authentication Profile

Super Coffee Authentication

Authentication

Super Coffee secures its APIs with oauth2, openIdConnect, and none across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, refreshToken, and jwtBearer flow(s).

CompanyFood and BeverageConsumer Packaged GoodsRetailE-CommerceAgentic CommerceUniversal Commerce ProtocolMCPShopify

Methods: oauth2, openIdConnect, none Schemes: 3 OAuth flows: authorizationCode, refreshToken, jwtBearer API key in:

Security Schemes

ucp-mcp-anonymous none

shopify-customer-account-oidc openIdConnect

shopify-customer-account-oauth2 oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-08-05'
method: searched
source: https://www.drinksupercoffee.com/.well-known/openid-configuration
docs: https://www.drinksupercoffee.com/agents.md
note: >-
  Super Coffee publishes no OpenAPI, so this profile is not derived from
  securitySchemes. It is read from the storefront's live OAuth 2.0 / OpenID
  Connect discovery documents and from the observed behaviour of the UCP MCP
  endpoint. The authorization server is operated by Shopify on Super Coffee's
  behalf (shop id 14905858), not by Super Coffee.
summary:
  types: [oauth2, openIdConnect, none]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwtBearer]
  anonymous_surface: true
schemes:
- name: ucp-mcp-anonymous
  type: none
  description: >-
    The UCP MCP endpoint answers tools/list and catalog/cart/checkout tool calls
    without credentials. Identity is asserted per call via the required meta.ucp-agent.profile
    URI rather than a bearer token. Payment completion is gated on an approved buyer
    payment instrument plus contemporaneous human approval, not on API authentication.
  sources:
  - https://www.drinksupercoffee.com/api/ucp/mcp
  evidence: anonymous POST tools/list returned HTTP 200 with 13 tools on 2026-08-05
- name: shopify-customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.drinksupercoffee.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/14905858
  description: OpenID Connect for Shopify customer accounts on this storefront.
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [public]
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  sources:
  - https://www.drinksupercoffee.com/.well-known/openid-configuration
- name: shopify-customer-account-oauth2
  type: oauth2
  description: OAuth 2.0 Authorization Server Metadata (RFC 8414) for customer accounts.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/14905858/oauth/authorize
    tokenUrl: https://shopify.com/authentication/14905858/oauth/token
    pkce: true
    code_challenge_methods_supported: [S256]
  grant_types_supported:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_endpoint_auth_methods_supported: [client_secret_basic]
  jwks_uri: https://shopify.com/authentication/14905858/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/14905858/logout
  scopes: see scopes/super-coffee-scopes.yml
  sources:
  - https://www.drinksupercoffee.com/.well-known/oauth-authorization-server
x-evidence:
  fetched: '2026-08-05'
  urls:
  - url: https://www.drinksupercoffee.com/.well-known/openid-configuration
    http_status: 200
  - url: https://www.drinksupercoffee.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://www.drinksupercoffee.com/api/ucp/mcp
    http_status: 200

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/super-coffee-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.