--- title: "AR-ACT-01: Auth an agent can finish | Agent Ready Checklist" description: "AR-ACT-01 (SHOULD, Act layer): Auth an agent can finish. What it asks, the evidence, the command that verifies it and the fix on 19 platforms." canonical: https://agentreadychecklist.com/checklist/ar-act-01 site: "Agent Ready Checklist" last_updated: 2026-11-05 section: "Checklist" --- # AR-ACT-01: Auth an agent can finish | Agent Ready Checklist > AR-ACT-01 (SHOULD, Act layer): Auth an agent can finish. What it asks, the evidence, the command that verifies it and the fix on 19 platforms. Source: https://agentreadychecklist.com/checklist/ar-act-01 Site: Agent Ready Checklist Last reviewed: 2026-11-05 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # AR-ACT-01: Auth an agent can finish AR-ACT-01 is a SHOULD on the act layer: Make authentication completable by an agent: self-serve keys with documented scopes; for user-delegated access, OAuth 2.0 with metadata under /.well-known. It applies to products agents act on. 19 of 19 platforms have a recipe below, 4 of them workarounds. The kit check oauth-metadata tests it with one command. ## The requirement Identifier AR-ACT-01 Level SHOULD Layer Act Applies to products agents act on Checked by Ora, matched on this site, Cloudflare oauthDiscovery, Cloudflare oauthProtectedResource, Verify Kit oauth-metadata Ora check [oauth-support, scoped-permissions](#ora) The statement Make authentication completable by an agent: self-serve keys with documented scopes; for user-delegated access, OAuth 2.0 with metadata under /.well-known. ## Why - The spec cites RFC 8414 (authorization server metadata) and RFC 9728 (protected resource metadata) as best practice.primary source: [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md), read 2026-11-04 - MCP authorization requires servers to implement OAuth 2.0 Protected Resource Metadata and clients to use it to find the authorization server.primary source, 2025-06-18: [modelcontextprotocol.io/specification/2025-06-18/basic/authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), read 2026-11-04 - Cloudflare checks /.well-known/openid-configuration or /.well-known/oauth-authorization-server for issuer, authorization\_endpoint, token\_endpoint and jwks\_uri.primary source: [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md), read 2026-11-04 ## How to verify ### [OAuth metadata an agent can find](https://agentreadychecklist.com/kit/oauth-metadata/) ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=oauth-metadata ``` Fetches /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/oauth-protected-resource and checks for issuer and token\_endpoint, or resource and authorization\_servers. An API that declares itself open also passes: an OpenAPI document (from /openapi.json or the api-catalog) with security \[\] and no securitySchemes, plus /auth.md, since no credential exists to describe. **It cannot prove:** Does not run a grant; cannot test self-serve API key creation; cannot tell whether an API that declares itself open should have been gated. ### The one-line version curl -s /.well-known/oauth-authorization-server | jq -e ".issuer and .token\_endpoint". ## Verify with Ora 2 checks in Ora's catalogue (contract 1.38.0, read 2026-11-05) read this row. Each entry says what the check looks at and why this page lists it. - `oauth-support` OAuth 2.0 support Looks for OAuth 2.0, or an explicitly open API that needs no keys at all. Usability, 5 points, required; catalogue applicability domain-only. Listed because: same name, `oauth`. - `scoped-permissions` Scoped permissions Looks for declared OAuth scopes in OpenAPI security schemes or RFC 9728 metadata, not mentions in prose. Usability, 5 points, recommended; catalogue applicability domain-only. Listed because: same name, `scope`. ### Run just these checks ```bash curl -s -X POST https://ora.ai/api/scan/checks -H 'content-type: application/json' -d '{"url":"https://example.com","checkIds":["oauth-support","scoped-permissions"]}' ``` This calls the endpoint Ora documents for re-verifying a fix. It sends no cache, returns a result for each id and no total score, and spends one scan from the daily budget. Replace the URL with yours. [How to re-verify one fix](https://agentreadychecklist.com/guides/re-verify-one-fix-with-ora/). ### Or audit the whole site ```bash npx ax@0.10 audit https://example.com --min-score 70 ``` Exit code 1 means the score is below the number you passed, so the same line gates a deploy: [the CI recipe](https://agentreadychecklist.com/guides/gate-deploys-on-agent-readiness-in-ci/). [Why this site recommends Ora, and where it falls short](https://agentreadychecklist.com/verify-with-ora/). ## Fix it on your platform ### Next.js (App Router)recipe Run an authorization server, or an identity provider, that issues scoped tokens, and serve its RFC 8414 metadata from the app as the CF-OAUTH-DISCOVERY recipe shows (/platforms/nextjs-app-router/#cf-oauth-discovery). Also offer self-serve API keys with documented scopes. Next.js 16.x (npm latest 16.4.5, read 2026-11-04); docs at nextjs.org/docs/app. Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Next.js (App Router) recipes](https://agentreadychecklist.com/platforms/nextjs-app-router/#ar-act-01) ### Astrorecipe Run an authorization server, or an identity provider, that issues scoped tokens, and serve its RFC 8414 metadata from the app as the CF-OAUTH-DISCOVERY recipe shows (/platforms/astro/#cf-oauth-discovery). Also offer self-serve API keys with documented scopes. Astro 7.x (npm latest astro 7.4.5, @astrojs/sitemap 3.7.4, read 2026-11-04). Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Astro recipes](https://agentreadychecklist.com/platforms/astro/#ar-act-01) ### Nuxtrecipe Run an authorization server, or an identity provider, that issues scoped tokens, and serve its RFC 8414 metadata from the app as the CF-OAUTH-DISCOVERY recipe shows (/platforms/nuxt/#cf-oauth-discovery). Also offer self-serve API keys with documented scopes. Nuxt 4.x (npm latest nuxt 4.6.4, @nuxtjs/robots 7.0.2, @nuxtjs/sitemap 9.1.0, read 2026-11-04). Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Nuxt recipes](https://agentreadychecklist.com/platforms/nuxt/#ar-act-01) ### SvelteKitrecipe Run an authorization server, or an identity provider, that issues scoped tokens, and serve its RFC 8414 metadata from the app as the CF-OAUTH-DISCOVERY recipe shows (/platforms/sveltekit/#cf-oauth-discovery). Also offer self-serve API keys with documented scopes. SvelteKit (npm latest @sveltejs/kit 3.1.1, read 2026-11-04); docs at svelte.dev/docs/kit. Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All SvelteKit recipes](https://agentreadychecklist.com/platforms/sveltekit/#ar-act-01) ### Remix and React Router (framework mode)recipe Run an authorization server, or an identity provider, that issues scoped tokens, and serve its RFC 8414 metadata from the app as the CF-OAUTH-DISCOVERY recipe shows (/platforms/remix-react-router/#cf-oauth-discovery). Also offer self-serve API keys with documented scopes. React Router framework mode (npm latest react-router 8.5.1; Remix v2 @remix-run/node 2.17.5, read 2026-11-04); docs at reactrouter.com. Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Remix and React Router (framework mode) recipes](https://agentreadychecklist.com/platforms/remix-react-router/#ar-act-01) ### Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront)workaround Run the token endpoint, and the RFC 8414 metadata for it, in Pages Functions, which run code at the edge for a Cloudflare Pages site, and give agents self-serve keys with documented scopes (the CF-OAUTH-DISCOVERY recipe, /platforms/static-hosting/#cf-oauth-discovery). Host documentation as published on 2026-11-04 (no version numbers; config files \_headers, \_redirects, vercel.json, 404.html). Derived from Plain static hosting's documentation read on 2026-11-04. [developers.cloudflare.com/pages/functions/](https://developers.cloudflare.com/pages/functions/) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront) recipes](https://agentreadychecklist.com/platforms/static-hosting/#ar-act-01) ### WordPress and Elementorworkaround Core ships application passwords, which give an agent a self-serve credential for the REST API, but not an OAuth server (its CF-OAUTH-DISCOVERY recipe). For user-delegated access, install an OAuth server plugin that publishes /.well-known/oauth-authorization-server, and document the scopes. WordPress 7.1.4 (core release from the version-check API), Elementor 4.3.6 (plugin directory, updated 2026-11-02), Yoast SEO 28.8 noted for llms.txt; docs read 2026-11-04. Derived from WordPress and Elementor's documentation read on 2026-11-04. [developer.wordpress.org/rest-api/using-the-rest-api/authentication/](https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All WordPress and Elementor recipes](https://agentreadychecklist.com/platforms/wordpress-elementor/#ar-act-01) ### Shopify (Online Store 2.0 themes)recipe For agents that call Shopify's agent MCP servers, credentials are self-serve: create a client ID and secret in the Catalog section of Dev Dashboard, exchange them at https://api.shopify.com/auth/access\_token for a bearer token (a JWT with a 60-minute lifetime) and send it in the Authorization header. Requests are authenticated or signed, and higher trust tiers give broader access. Hosted SaaS, Online Store 2.0 Liquid themes, docs read 2026-11-04; storefront behaviour probed live on one Shopify store the same day. Derived from Shopify's documentation read on 2026-11-04. [shopify.dev/docs/agents/carts-and-checkout/checkout-mcp](https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Shopify (Online Store 2.0 themes) recipes](https://agentreadychecklist.com/platforms/shopify/#ar-act-01) ### Webflowrecipe Webflow's Data API takes two kinds of token: a Site Token that you create for one site, and an OAuth token from an OAuth app that users authorize. Each suits a different use, so choose by who the agent acts for. Hosted SaaS, help center articles read 2026-11-04 (updated dates 2024-10-14 to 2026-10-29). Derived from Webflow's documentation read on 2026-11-04. [developers.webflow.com/data/reference/authentication](https://developers.webflow.com/data/reference/authentication) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Webflow recipes](https://agentreadychecklist.com/platforms/webflow/#ar-act-01) ### Framerworkaround Workaround: run the identity provider or authorization server on a subdomain or API domain you control, with self-serve keys and documented scopes, and publish its OAuth metadata there (the CF-OAUTH-DISCOVERY recipe, /platforms/framer/#cf-oauth-discovery). Hosted SaaS, help articles read 2026-11-04 (marked updated 2026-09-15). Generic step from the AgentReady specification; not platform-specific. [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Framer recipes](https://agentreadychecklist.com/platforms/framer/#ar-act-01) ### Wix (Wix Editor and Wix Studio)recipe Wix supports OAuth and API keys, and app tokens minted with client\_credentials. An API key gives site-level or account-level administrative access for server-to-server automation, and OAuth covers code that runs outside the Wix dashboard, editor or site and acts as a visitor, member or Wix app. Choose the least privilege that does the job. Hosted SaaS, help center read 2026-11-04. Derived from Wix's documentation read on 2026-11-04. [dev.wix.com/docs/api-reference/articles/authentication/about-api-keys](https://dev.wix.com/docs/api-reference/articles/authentication/about-api-keys) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Wix (Wix Editor and Wix Studio) recipes](https://agentreadychecklist.com/platforms/wix/#ar-act-01) ### Squarespace (version 7.1)recipe Commerce API requests authenticate with an API key or an OAuth 2.0 access token, and each key or token carries the permission levels you pick per API. For an app that acts for other Squarespace users, register an OAuth client and use the OAuth 2.0 flow. Hosted SaaS, version 7.1 sites, help center read 2026-11-04 (articles updated 2026-07-17 to 2026-11-03). Derived from Squarespace's documentation read on 2026-11-04. [developers.squarespace.com/commerce-apis/authentication-and-permissions](https://developers.squarespace.com/commerce-apis/authentication-and-permissions) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Squarespace (version 7.1) recipes](https://agentreadychecklist.com/platforms/squarespace/#ar-act-01) ### HubSpot CMS (Content Hub)recipe HubSpot apps authenticate with OAuth when they are installed on several accounts, and with a static auth access token when they are installed on one account at a time. Client credentials tokens act on behalf of the app, and a developer API key covers the few settings that need one. Hosted SaaS, Content Hub, knowledge base and developer docs read 2026-11-04. Derived from HubSpot CMS's documentation read on 2026-11-04. [developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All HubSpot CMS (Content Hub) recipes](https://agentreadychecklist.com/platforms/hubspot-cms/#ar-act-01) ### Docusaurusworkaround Docusaurus is a static site generator, so it has no authorization server or API keys of its own. Workaround: run the identity provider or authorization server on a subdomain or API domain you control, with self-serve keys and documented scopes, and publish its OAuth metadata there (the CF-OAUTH-DISCOVERY recipe, /platforms/docusaurus/#cf-oauth-discovery). 3.10.2 (npm @docusaurus/core latest, read 2026-11-04). Derived from Docusaurus's documentation read on 2026-11-04. [docusaurus.io/docs/deployment](https://docusaurus.io/docs/deployment) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Docusaurus recipes](https://agentreadychecklist.com/platforms/docusaurus/#ar-act-01) ### Mintlifyrecipe For docs behind sign-in, the platform's own OAuth route applies: Sites with authentication advertise OAuth protected resource metadata with rel="oauth-protected-resource" in the Link header; the authed MCP uses OAuth 2. Hosted SaaS, docs read 2026-11-04. Derived from Mintlify's documentation read on 2026-11-04. [mintlify.com/docs/ai/llmstxt](https://mintlify.com/docs/ai/llmstxt) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Mintlify recipes](https://agentreadychecklist.com/platforms/mintlify/#ar-act-01) ### GitBookrecipe For docs behind sign-in, the platform's own OAuth route applies: Fully authenticated sites let MCP clients sign in through MCP discovery and OAuth. Hosted SaaS, docs read 2026-11-04. Derived from GitBook's documentation read on 2026-11-04. [gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs](https://gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All GitBook recipes](https://agentreadychecklist.com/platforms/gitbook/#ar-act-01) ### ReadMerecipe For docs behind sign-in, the platform's own OAuth route applies: For docs behind OAuth sign-in, set Discovery Type under Authentication and Access; keep None for public docs (endpoints then return 404). Hosted SaaS, docs read 2026-11-04. Derived from ReadMe's documentation read on 2026-11-04. [docs.readme.com/main/docs/ai-discoverability](https://docs.readme.com/main/docs/ai-discoverability) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All ReadMe recipes](https://agentreadychecklist.com/platforms/readme/#ar-act-01) ### Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront)recipe Use SLAS, the Shopper Login and API Access Service, which is B2C Commerce's own authorization server. Its access-token requests use grant types defined by OAuth 2.1, and the grant depends on whether the SLAS client is public or private and on how the shopper signs in. There is no authorization server to build. Hosted SaaS (B2C Commerce help release 264.0.0); PWA Kit retail-react-app 10.3.0 and pwa-kit-runtime 3.21.0 on npm, read 2026-11-04. Derived from Salesforce B2C Commerce's documentation read on 2026-11-04. [developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront) recipes](https://agentreadychecklist.com/platforms/salesforce-commerce-cloud/#ar-act-01) ### Adobe Commerce and Magento Open Sourcerecipe Register an integration in the Admin: it defines which API resources the application can reach, all of them or a chosen subset, and it issues the credentials. That covers self-serve credentials with documented scopes. Adobe's flow is OAuth 1.0a, so OAuth 2.0 delegation to an agent needs outside help. Workaround: put an OAuth 2.0 authorization server in front and publish its metadata (the CF-OAUTH-DISCOVERY recipe, /platforms/adobe-commerce/#cf-oauth-discovery). 2.4.9 (GitHub tag published 2026-05-12; 2.4.10-alpha1 tagged 2026-10-13); release notes read 2026-11-04. Derived from Adobe Commerce and Magento Open Source's documentation read on 2026-11-04. [developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth](https://developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth) and [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md). [All Adobe Commerce and Magento Open Source recipes](https://agentreadychecklist.com/platforms/adobe-commerce/#ar-act-01) ## What it does not do - Metadata does not prove the flow completes; test the full grant with the agent clients you support. - The studies measured OpenAPI retrieval, not successful authentication. ## Common mistakes - Key creation that requires a sales call. - Metadata issuer that does not match the URL it is served from. - No PKCE support for public clients. ## Related - Guide: [How to add OAuth metadata](https://agentreadychecklist.com/guides/add-oauth-metadata/) - Term: [.well-known](https://agentreadychecklist.com/glossary/well-known/) ## Sources - [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md)read 2026-11-04 - [modelcontextprotocol.io/specification/2025-06-18/basic/authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)read 2026-11-04 - [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md)read 2026-11-04 - [developers.cloudflare.com/pages/functions/](https://developers.cloudflare.com/pages/functions/)read 2026-11-04 - [developer.wordpress.org/rest-api/using-the-rest-api/authentication/](https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/)read 2026-11-04 - [shopify.dev/docs/agents/carts-and-checkout/checkout-mcp](https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp)read 2026-11-04 - [developers.webflow.com/data/reference/authentication](https://developers.webflow.com/data/reference/authentication)read 2026-11-04 - [dev.wix.com/docs/api-reference/articles/authentication/about-api-keys](https://dev.wix.com/docs/api-reference/articles/authentication/about-api-keys)read 2026-11-04 - [developers.squarespace.com/commerce-apis/authentication-and-permissions](https://developers.squarespace.com/commerce-apis/authentication-and-permissions)read 2026-11-04 - [developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview)read 2026-11-04 - [docusaurus.io/docs/deployment](https://docusaurus.io/docs/deployment)read 2026-11-04 - [mintlify.com/docs/ai/llmstxt](https://mintlify.com/docs/ai/llmstxt)read 2026-11-04 - [gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs](https://gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs)read 2026-11-04 - [docs.readme.com/main/docs/ai-discoverability](https://docs.readme.com/main/docs/ai-discoverability)read 2026-11-04 - [developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html)read 2026-11-04 - [developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth](https://developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth)read 2026-11-04 - [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414)read 2026-11-04 - [ora.ai/api/checks, contract 1.38.0](https://ora.ai/api/checks?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=requirement)read 2026-11-05 - [ora.ai/llms-full.txt](https://ora.ai/llms-full.txt?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=requirement)read 2026-11-05 - [registry.npmjs.org/ax, the ax README](https://registry.npmjs.org/ax)read 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Fix it on - [Next.js (App Router)recipe](#p-nextjs-app-router) - [Astrorecipe](#p-astro) - [Nuxtrecipe](#p-nuxt) - [SvelteKitrecipe](#p-sveltekit) - [Remix and React Router (framework mode)recipe](#p-remix-react-router) - [Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront)workaround](#p-static-hosting) - [WordPress and Elementorworkaround](#p-wordpress-elementor) - [Shopify (Online Store 2.0 themes)recipe](#p-shopify) - [Webflowrecipe](#p-webflow) - [Framerworkaround](#p-framer) - [Wix (Wix Editor and Wix Studio)recipe](#p-wix) - [Squarespace (version 7.1)recipe](#p-squarespace) - [HubSpot CMS (Content Hub)recipe](#p-hubspot-cms) - [Docusaurusworkaround](#p-docusaurus) - [Mintlifyrecipe](#p-mintlify) - [GitBookrecipe](#p-gitbook) - [ReadMerecipe](#p-readme) - [Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront)recipe](#p-salesforce-commerce-cloud) - [Adobe Commerce and Magento Open Sourcerecipe](#p-adobe-commerce) Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.