Protecting app created tags

dylanpierce
Shopify Partner
138 2 43

Hi there,

A majority of apps rely on tagging orders & customers for keeping the merchant informed during critical parts of fulfillment.

However, both the GraphQL and REST endpoints for adding tags to taggables (orders & customers) will overwrite existing tags left by other apps.

This leads to app devs to accidentally delete other app's tags, and the merchant and other developers have no idea which app is the culprit.

We need a basic permissions model added to the tagging endpoints:

As an app developer, I should only be able to update tags left by my app.

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely
0 Likes
HunkyBill
Shopify Expert
4504 46 491

I would say if you are using tags to keep a merchant abreast of what is happening during critical parts of fulfillment, you are doing it wrong.

Straight up, fulfillment now comes with its own messaging between Shopify and the fulfillment service, allowing pretty fine-grained controls and feedback during the so-called critical parts of fulfillment.

Hate to burst your bubble, but the chances of getting App-specific tags are next to nil. You get App-specific Metafield resources, which allows you to "tag" a product or order with crucial data other apps cannot mess with. But ordinary product tags? I highly doubt it.

Mabey you could also spell out how exactly you use tagging and the community could try and offer you some alternatives? As you say, the low-fruit, weak solution most developers have selected, using tags, is really bush-league. Your request kind of speaks to the fact we can not easily add to an order timeline of events, nor can we create notes for products, easily. One would think though that those kinds of things might be easier for Shopify to provide for. Again though, imagine the abuse that could be mixed into an order over time.

Custom Shopify Apps built just for you! hunkybill@gmail.com http://www.resistorsoftware.com
0 Likes
dylanpierce
Shopify Partner
138 2 43

Sure I can give more context.

One of my apps provides ID verification for orders that require it - namely age restricted or high risk goods like jewelry, alcohol, vaping, cannabis, etc.

This doesn't affect fulfillment directly, but it does add a new process that the merchant needs to be aware of so they don't fulfill orders immediately that require ID verification. They need to be kept in the loop as much as possible so they don't ship a good that hasn't completed this step, or to know which orders do require it.

I'm not aware of a way to create new order statuses - and I wouldn't expect Shopify to allow that kind of control.

So currently I rely on tagging these orders to provide visibility to the merchants during each step of the process:

* ID verification required
* ID verification completed
* ID verification failed

I saw the metadata resource, which is interesting. That would be helpful for internal usage so my app doesn't require ID verification again on already verified customers, however as far as I'm aware metadata is not visible in the Order or Customer pages. But correct me if I'm wrong there.

So that leaves the other option - notes. But those are also tricky because they are also free game and only populate 1 line in the order page. Right now they're (ab)used as a de-facto way to leave timeline events on the timeline.

Is there some other data attribute that's more appropriate for showing app created additional processes to the post-checkout flow to orders?

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely
0 Likes
HunkyBill
Shopify Expert
4504 46 491

The most obvious thing I would do is add an Admin link to the order details. The link hits your App with the order ID and can read "Verification" or whatever you want.

In your App, you can then securely deal with the status of each line item. You can easily show the merchant whether it is good, bad, or ugly. Additionally, no amount of fiddling with tags or order notes makes up for the fact that if an item requires the merchant to action something, ie) get verification and assign it as "done", that all happens in the App anyway. Or your App is near useless at what should be a fairly easy and clean pattern to implement. 

You can tie in line item properties for this too. And Metafield resources. In fact, nothing screams this pattern more than verification. I built all this out 8 years ago, and it worked fine, then, and I see no reason you could not make it work. Just because the merchant has to click a link, does not make this "unfriendly" or "difficult". 

 

 

Custom Shopify Apps built just for you! hunkybill@gmail.com http://www.resistorsoftware.com
0 Likes
dylanpierce
Shopify Partner
138 2 43

Yes the app is the source of truth when it comes to the ID verification data - and yes it does implement the Admin link from the order & customer details to the respective ID checks.

However, I don't expect a merchant that only spot checks orders with high risk to open each order's "View ID verification results" link to learn if the order event required ID verification or not.

On average 1% of orders are flagged as high risk. Not leaving some kind of feedback on the order itself would force a merchant to open the "View ID verification results" link on the other 99% of the orders.

I know there's a tag on high risk orders, but that's just an example. You can configure the app to require ID checks on certain products/collections or when the customer's billing & shipping address don't line up, or if the order price is above a certain amount. There are a number of conditions that could require it.

Merchants and their staff are busy. I want to provide them an at-a-glance badge, tag or note of some kind that gives them a clue if the order requires ID verification - and if it does it should be able to tell them if it's cleared to fulfill or not.

Other apps are forced to use tags for this same purpose, whether they agree it's a good pattern or not. The very least we can do is have some kind of simple ownership check to make sure apps aren't able to delete each others tags.

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely
0 Likes
HunkyBill
Shopify Expert
4504 46 491

So move up a level. It takes no effort for you to scan as many current orders as it takes, and then provide a screen with links or actionable clicks to deal with the issues. For that, as you say, instead of merchant being BLIND and missing the 1% of important things, you hand them that on a platter.

How is that something you missed? I'd say just off the top of my head, the strategy of burying important information in TAGS is dumb, and should never be relied, nor order notes, and anyone who has used Shopify as a merchant would know, that display is so WINGUS WONGUS now with little colored badges and other knickknacks, that all their PhD thesis studies on what works for UX seems to be "Myspace was nice!".

So ya. Why not make a one-click summary a merchant can reach that helps them manage everything? Seems to solve all your problems.

Custom Shopify Apps built just for you! hunkybill@gmail.com http://www.resistorsoftware.com
0 Likes