Super Coffee · Authentication Profile

Super Coffee Authentication

Authentication

Super Coffee secures its APIs with oauth2, openIdConnect, and none across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, refreshToken, and jwtBearer flow(s).

CompanyFood and BeverageConsumer Packaged GoodsRetailE-CommerceAgentic CommerceUniversal Commerce ProtocolModel Context ProtocolShopify
Methods: oauth2, openIdConnect, none Schemes: 3 OAuth flows: authorizationCode, refreshToken, jwtBearer API key in:

Security Schemes

ucp-mcp-anonymous none
shopify-customer-account-oidc openIdConnect
shopify-customer-account-oauth2 oauth2
· flows: authorizationCode

Source

Authentication Profile

super-coffee-authentication.yml Raw ↑ 
generated: '2026-08-05'
method: searched
source: https://www.drinksupercoffee.com/.well-known/openid-configuration
docs: https://www.drinksupercoffee.com/agents.md
note: >-
  Super Coffee publishes no OpenAPI, so this profile is not derived from
  securitySchemes. It is read from the storefront's live OAuth 2.0 / OpenID
  Connect discovery documents and from the observed behaviour of the UCP MCP
  endpoint. The authorization server is operated by Shopify on Super Coffee's
  behalf (shop id 14905858), not by Super Coffee.
summary:
  types: [oauth2, openIdConnect, none]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken, jwtBearer]
  anonymous_surface: true
schemes:
- name: ucp-mcp-anonymous
  type: none
  description: >-
    The UCP MCP endpoint answers tools/list and catalog/cart/checkout tool calls
    without credentials. Identity is asserted per call via the required meta.ucp-agent.profile
    URI rather than a bearer token. Payment completion is gated on an approved buyer
    payment instrument plus contemporaneous human approval, not on API authentication.
  sources:
  - https://www.drinksupercoffee.com/api/ucp/mcp
  evidence: anonymous POST tools/list returned HTTP 200 with 13 tools on 2026-08-05
- name: shopify-customer-account-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.drinksupercoffee.com/.well-known/openid-configuration
  issuer: https://shopify.com/authentication/14905858
  description: OpenID Connect for Shopify customer accounts on this storefront.
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [public]
  claims_supported: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  sources:
  - https://www.drinksupercoffee.com/.well-known/openid-configuration
- name: shopify-customer-account-oauth2
  type: oauth2
  description: OAuth 2.0 Authorization Server Metadata (RFC 8414) for customer accounts.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://shopify.com/authentication/14905858/oauth/authorize
    tokenUrl: https://shopify.com/authentication/14905858/oauth/token
    pkce: true
    code_challenge_methods_supported: [S256]
  grant_types_supported:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_endpoint_auth_methods_supported: [client_secret_basic]
  jwks_uri: https://shopify.com/authentication/14905858/.well-known/jwks.json
  end_session_endpoint: https://shopify.com/authentication/14905858/logout
  scopes: see scopes/super-coffee-scopes.yml
  sources:
  - https://www.drinksupercoffee.com/.well-known/oauth-authorization-server
x-evidence:
  fetched: '2026-08-05'
  urls:
  - url: https://www.drinksupercoffee.com/.well-known/openid-configuration
    http_status: 200
  - url: https://www.drinksupercoffee.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://www.drinksupercoffee.com/api/ucp/mcp
    http_status: 200