Shop domain proxies

The bearer-only Shop API proxy.

The storefront forwards /api/v1/* and /api/openapi.json through the API service binding or configured HTTP origin. An unconfigured target returns 503. Other unclaimed /api paths return a 404 problem.

MCP clients connect directly to the canonical MCP_ORIGIN. The storefront serves no /mcp endpoint or MCP protected-resource metadata.

Proxy rules

• Forward the method, raw body, Authorization, Content-Type and Accept through explicit header allowlists.
• Strip cookies, session, guest, operator, shopper-IP and forwarding headers. Calls never inherit browser sessions.
• Return status, body, WWW-Authenticate, Retry-After and streams unchanged; strip set-cookie.
• Apply no caching, retries or redirects. API errors retain their application/problem+json bodies.

The Shop API audience is its identifier, so this alias needs no extra Auth0 resource. Poppy discovery advertises the API origin directly; the proxy does not forward DPoP proofs.

Auth0 Action and Auth0 proxy callbacks go directly to the API. The storefront owns POST /api/auth0/backchannel-logout, outside this proxy. Stripe calls the API’s /webhooks/stripe directly; the storefront has no webhook route, so /api/webhooks/stripe is an ordinary unclaimed path (404).