KLAIM Amsterdam API authentication and permissions

KLAIM Amsterdam uses Shopify's native UCP service. Public service discovery, MCP initialization, tool listing and product JSON reads do not require a KLAIM-issued API key. KLAIM does not operate a separate OAuth authorization server. The developer portal provides optional scoped keys for the KLAIM read-only API and its disconnected sandbox. These keys cannot call Shopify shopping or customer-data operations.

Use the least privileged access

For public product information, use a public read. A catalog read never authorizes customer-data access or a purchase. Production agents should follow Shopify's traffic identification and authentication requirements; anonymous traffic has limited shared capacity.

Credentials and named scopes

Shopify issues agent credentials through its developer platform and enforces their permissions. Supported order access requires the Shopify scope read_global_api_orders and is restricted to orders placed through the agent. Completing purchases requires separately granted permission and explicit buyer authorization. KLAIM's public catalog does not grant either permission.

The OpenAPI document declares Shopify's documented client-credentials flow at https://api.shopify.com/auth/access_token, with the named scopes read_global_api_catalog_search and read_global_api_orders. Request only the access needed for your task. Shopify assigns and enforces the actual grants; a scope declaration does not grant access. Follow Shopify's credential guide for the provider's JSON token request and your own approved client credentials.

An HTTP bearer scheme also describes existing Shopify agent JWTs. No merchant Admin credential is public, and neither a catalog token nor an OAuth scope declaration authorizes purchase completion.

Agent profile and buyer context

Read the live UCP profile, negotiate a supported version, and use tools/list. Tool calls require a reachable public UCP profile URL in meta.ucp-agent.profile. Supply buyer country and currency where the tool schema supports them. Follow Shopify's requirements for request signatures or bearer credentials and the Shopify-Buyer-IP header.

Buyer authorization

Use supported UCP or Shop tools for shopping actions. Follow buyer review and handoff requirements. Never script checkout form submission or treat an API error, a created checkout, or an unconfirmed provider response as a completed purchase.

Back to KLAIM Amsterdam developer documentation · OpenAPI reference

KLAIM read-only keys

Generate a free optional key at the developer portal. Choose live or sandbox and the minimum needed scopes: catalog:read for public products and resources:read for public MCP documentation resources. The server enforces the key's environment and scopes, stores only its hash, and expires it after 90 days. DELETE /v1/keys/current revokes only the supplied key. Public anonymous reads remain available.