---
title: "Authentication for agents | Discount Filter Shop"
description: "How AI agents and integrations get credentials for the Discount Filter Shop APIs: public Store API, scoped WooCommerce API keys, and OAuth 2.1 for the MCP server."
canonical: https://discountfiltershop.com/auth.md
last-updated: 2026-10-27
site: "Discount Filter Shop"
format: text/markdown
---

# auth.md: Authentication for agents

Discount Filter Shop (discountfiltershop.com) exposes three API surfaces. Pick the one that matches what you need and request the narrowest access.

## 1. Shopping: no credentials needed

The Store API is public. Browse, build a cart and check out without any key:

```
curl https://discountfiltershop.com/wp-json/wc/store/v1/products?search=EDR1RXD1
curl -i https://discountfiltershop.com/wp-json/wc/store/v1/cart
```

The cart response includes a `Cart-Token` header. Send it back as the `Cart-Token` request header on `POST /wc/store/v1/cart/add-item` and `POST /wc/store/v1/checkout`. The token identifies one anonymous cart and nothing else. Specification: [openapi.json](https://discountfiltershop.com/openapi.json).

## 2. Shop management: WooCommerce API key with a permission scope

The WooCommerce REST API (`https://discountfiltershop.com/wp-json/wc/v3`) is for integrations that read or change orders, products and customers. Credentials are a consumer key and consumer secret, sent as HTTP Basic authentication over HTTPS. Each key carries exactly one scope:

| Scope | Grants |
| --- | --- |
| `read` | GET requests only: products, orders, customers, reports |
| `write` | POST, PUT and DELETE only |
| `read_write` | Both |

Ask for `read` unless you must change data. Two ways to get a key:

1. The store owner creates it in WooCommerce > Settings > Advanced > REST API and sends it to you.
2. The app authorization flow: send the store owner to
   `https://discountfiltershop.com/wc-auth/v1/authorize?app_name=<your app>&scope=read&user_id=<your reference>&return_url=<url>&callback_url=<https url>`.
   After they approve, WooCommerce POSTs `{consumer_key, consumer_secret, key_permissions}` to your `callback_url`. Reference: https://woocommerce.github.io/woocommerce-rest-api-docs/#authentication.

Machine-readable scope list: [https://discountfiltershop.com/.well-known/oauth-protected-resource/wp-json/wc/v3](https://discountfiltershop.com/.well-known/oauth-protected-resource/wp-json/wc/v3) (RFC 9728).

## 3. Site administration: OAuth 2.1 for the MCP server

The MCP server (Streamable HTTP at `https://discountfiltershop.com/wp-json/stifli-flex-mcp/v1/messages` for MCP 2026-07-28, legacy SSE at `https://discountfiltershop.com/wp-json/stifli-flex-mcp/v1/sse`; connection details in the [server card](https://discountfiltershop.com/.well-known/mcp/server-card.json)) is protected by an OAuth 2.1 authorization server on this host (authorization code flow, PKCE S256, refresh tokens, client_id metadata documents, dynamic client registration). Discover it with:

- [https://discountfiltershop.com/.well-known/oauth-protected-resource](https://discountfiltershop.com/.well-known/oauth-protected-resource) (RFC 9728, resource and `scopes_supported`)
- [https://discountfiltershop.com/.well-known/oauth-authorization-server](https://discountfiltershop.com/.well-known/oauth-authorization-server) (RFC 8414)

The only scope is `mcp`. The consent step requires a WordPress staff login, so this surface is not available to shopping agents.

## Errors

Every JSON endpoint returns `{ "code": "...", "message": "...", "data": { "status": <http status> } }` on failure. `401` means missing credentials, `403` means the key lacks the scope, `429` means a rate limit (the filter identification endpoint allows 10 requests per hour per IP).

## More

- [Developer resources](https://discountfiltershop.com/developers/)
- [API catalog (RFC 9727)](https://discountfiltershop.com/.well-known/api-catalog)
- [llms.txt](https://discountfiltershop.com/llms.txt)
- Support: support@discountfiltershop.com

---

Discount Filter Shop · [Site overview for AI agents (llms.txt)](https://discountfiltershop.com/llms.txt) · [Developer resources](https://discountfiltershop.com/developers/) · [API catalog](https://discountfiltershop.com/.well-known/api-catalog) · [Sitemap](https://discountfiltershop.com/sitemap.xml)