UCP Score for 11knowledge.com

# Salla auth.md

You are an agent. This service supports **OAuth 2.0 Authorization Code flow with PKCE (S256)** for agent registration and authentication: discover → authorize → authenticate → exchange → use → refresh → revoke. Follow the steps in order.

Examples use the base URL `https://accounts.salla.com`.

## Step 1 — Discover

Fetch the OAuth 2.0 Authorization Server metadata to learn all endpoints and capabilities:

```
GET https://accounts.salla.com/.well-known/oauth-authorization-server
```

The `agent_auth` block tells you:
- `skill` — the URL of this document.
- `register_uri` / `identity_endpoint` — where you begin the registration/authorization flow.
- `identity_types_supported` — this service uses `service_auth` (the user authenticates at the Salla Login Page).
- `service_auth.claim_uri` / `claim_endpoint` — where the user goes to authenticate.
- `revocation_uri` — where you POST to revoke a token.

You can also fetch Protected Resource Metadata from the resource server:

```
GET https://accounts.salla.com/.well-known/oauth-protected-resource/store/v1
```

## Step 2 — Register (Authorize with PKCE)

Generate a PKCE code pair:

1. Generate a random `code_verifier` (43–128 characters).
2. Compute `code_challenge = base64url(SHA256(code_verifier))`.
3. Use `code_challenge_method = S256`.

Then redirect the user to the authorization endpoint:

```
GET https://accounts.salla.com/oauth/authorize?
  response_type=code
  &client_id=salla-agent
  &redirect_uri=<your-callback-uri>
  &scope=openid profile offline_access
  &state=<random-state>
  &code_challenge=<your-code-challenge>
  &code_challenge_method=S256
```

**Client registration:**
- Pre-configured public client: `salla-agent` (no secret required, PKCE is the sole authentication mechanism).
- Agents must provide a `redirect_uri` they control (e.g. `http://localhost:<port>/callback` for local agents). While PKCE protects the flow regardless of the redirect target, using a URI you own prevents token interception.
- Confidential clients (with secrets) are also supported if pre-registered.

## Step 3 — Authenticate and Exchange

The user authenticates on the Salla Login Page. After login, the browser redirects to your `redirect_uri` with `?code=<auth-code>&state=<your-state>`.

Exchange the authorization code for tokens:

```
POST https://accounts.salla.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<auth-code>
&redirect_uri=<your-callback-uri>
&client_id=salla-agent
&code_verifier=<your-code-verifier>
```

Response:

```json
{
  "access_token": "<token>",
  "token_type": "Bearer",
  "expires_in": 604800,
  "refresh_token": "<refresh-token>",
  "iss": "https://accounts.salla.com"
}
```

## Step 4 — Use the access token

```
GET https://accounts.salla.com/store/v1/products
Authorization: Bearer <access_token>
```

## Step 5 — Refresh

```
POST https://accounts.salla.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&refresh_token=<refresh-token>
&client_id=salla-agent
```

## Revocation

```
POST https://accounts.salla.com/oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=<access-or-refresh-token>
&client_id=salla-agent
```

Returns 200 with an empty body (RFC 7009).

## Introspection

```
POST https://accounts.salla.com/oauth/introspect
Content-Type: application/x-www-form-urlencoded

token=<access-token>
&client_id=salla-agent
```

Returns `{ "active": true, ... }` or `{ "active": false }`.

{"$schema":"https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json","version":"1.0","protocolVersion":"2025-06-18","serverInfo":{"name":"store","title":"Salla Store MCP Server","version":"1.0.0"},"description":"MCP server for managing shopping carts on a Salla store. Provides tools for cart generation, item management, and coupon application.","transport":{"type":"streamable-http","endpoint":"/mcp"},"capabilities":{"tools":{"listChanged":true},"logging":{}},"tools":["dynamic"]}

{"specVersion":"1.0","host":{"displayName":"11knowledge.com","documentationUrl":"https://docs.salla.dev"},"entries":[{"identifier":"urn:air:salla:11knowledge.com:storefront-mcp","displayName":"Storefront MCP","description":"Browse products, manage carts, and start checkout on this store via MCP tools.","type":"application/mcp-server-card+json","url":"https://11knowledge.com/.well-known/mcp/server-card.json","representativeQueries":["Search this store for a product","Add this product to my cart","Start checkout for my cart"]}]}

{"linkset":[{"anchor":"https://11knowledge.com/.well-known/api-catalog","item":[{"href":"https://11knowledge.com/.well-known/ucp"},{"href":"https://11knowledge.com/.well-known/mcp.json"},{"href":"https://11knowledge.com/.well-known/mcp/server-card.json"},{"href":"https://docs.salla.dev/2129395m0"},{"href":"https://docs.salla.dev/1724365m0"},{"href":"https://docs.salla.dev/1945677m0"},{"href":"https://docs.salla.dev/422688m0"},{"href":"https://docs.salla.dev/422610m0"}]},{"anchor":"https://11knowledge.com/.well-known/ucp","service-desc":[{"href":"https://ucp.dev/services/shopping/openapi.json","type":"application/json"}],"service-doc":[{"href":"https://ucp.dev/2026-04-08/specification/overview/","type":"text/html"}],"status":[{"href":"https://11knowledge.com/","type":"application/json"}]},{"anchor":"https://11knowledge.com/mcp","service-desc":[{"href":"https://11knowledge.com/.well-known/mcp/server-card.json","type":"application/json"}]},{"anchor":"https://docs.salla.dev/2129395m0","service-doc":[{"href":"https://docs.salla.dev/2129395m0","type":"text/html"}]},{"anchor":"https://docs.salla.dev/1724365m0","service-doc":[{"href":"https://docs.salla.dev/1724365m0","type":"text/html"}]},{"anchor":"https://docs.salla.dev/1945677m0","service-doc":[{"href":"https://docs.salla.dev/1945677m0","type":"text/html"}]},{"anchor":"https://docs.salla.dev/422688m0","service-doc":[{"href":"https://docs.salla.dev/422688m0","type":"text/html"}]},{"anchor":"https://docs.salla.dev/422610m0","service-doc":[{"href":"https://docs.salla.dev/422610m0","type":"text/html"}]}]}