You should be using Shopify's oauth flow. Its convenient for the merchant and critical for your app to get the right scopes added to the auth token your app will need
@Brian_S - thanks for responding - we are using the OAuth flow as discussed. The question is how can this be reviewed by the team. A shop owner needs to login to our system, authenticate their storie which will provide us we details on their orders. This needs to be done through our UI but I am not sure how I can give the Shopify testers credentials to login to our UI.