---
title: Shop domain proxies
description: The bearer-only Shop API proxy.
sidebar:
  order: 5
---

The storefront forwards `/api/v1/*` and `/api/openapi.json` through the `API` service binding or configured HTTP origin.
An unconfigured target returns 503. Other unclaimed `/api` paths return a 404 problem.

MCP clients connect directly to the canonical `MCP_ORIGIN`. The storefront serves no `/mcp` endpoint or MCP protected-resource metadata.

## Proxy rules

- Forward the method, raw body, `Authorization`, `Content-Type` and `Accept` through explicit header allowlists.
- Strip cookies, session, guest, operator, shopper-IP and forwarding headers. Calls never inherit browser sessions.
- Return status, body, `WWW-Authenticate`, `Retry-After` and streams unchanged; strip `set-cookie`.
- Apply no caching, retries or redirects. API errors retain their `application/problem+json` bodies.

The Shop API audience is its identifier, so this alias needs no extra Auth0 resource. Poppy discovery advertises the API origin directly; the proxy does not forward DPoP proofs.

Auth0 Action and Auth0 proxy callbacks go directly to the API. The storefront owns `POST /api/auth0/backchannel-logout`, outside this proxy. Stripe calls the API's `/webhooks/stripe` directly; the storefront has no webhook route, so `/api/webhooks/stripe` is an ordinary unclaimed path (404).