Skip to content

TRX-007Buy

OAuth / OpenID authorization server metadata published

Checks whether your shop publishes OAuth 2.0 or OpenID Connect authorization server metadata that an agent can read to sign a customer in.

What we check

RFC 8414 (June 2018) defines a JSON document at /.well-known/oauth-authorization-server that describes your sign-in server: its issuer, the response types it supports, and its authorization and token endpoints. OpenID Connect Discovery 1.0 (errata set 2, December 2023) defines the equivalent at /.well-known/openid-configuration, which must also list jwks_uri. We check that one of these is published at your shop's root and has the required fields.

Why it matters

When an agent acts for a customer who has an account with you, for example to check an order, it needs a standard way to ask that customer's permission. This metadata tells it where to send the customer to sign in and where to get a token. On Shopify the platform serves this document with new customer accounts, under a shopify.com issuer, which is legitimate.

How we check

We request /.well-known/oauth-authorization-server and, only if absent, /.well-known/openid-configuration. We never call endpoints it lists. PASS when it is a JSON object with issuer, response_types_supported (an array) and authorization_endpoint or token_endpoint (plus jwks_uri on the OpenID path), the issuer is https with no query or fragment, and it is served as application/json. WARN when the body is not a JSON object, a required field is missing (as in a soft-404 body), the issuer is unsafe, or the media type is wrong. FAIL when neither path has a document (404, 410, or your HTML page). We SKIP when the first path is bot-blocked, refused, or answered 429 or 5xx. Whether the issuer matches your domain is recorded, not graded.

How to fix it

  1. If customers, or agents on their behalf, can sign in to your shop, publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
  2. Include issuer (https, no query or fragment), response_types_supported, authorization_endpoint and token_endpoint; if you publish OpenID configuration, also include jwks_uri.
  3. Serve it as application/json with status 200.
  4. On Shopify this document comes from the platform with new customer accounts; on WooCommerce or a custom build it comes from whichever OAuth or OpenID provider handles your customer sign-in.

What good looks like

GET /.well-known/oauth-authorization-server
Content-Type: application/json

{
  "issuer": "https://auth.shop.example",
  "authorization_endpoint": "https://auth.shop.example/authorize",
  "token_endpoint": "https://auth.shop.example/token",
  "response_types_supported": ["code"],
  "jwks_uri": "https://auth.shop.example/jwks.json"
}

Sources