How can I install/publish my custom app using an API?

[Sneha_Subhash]

Hi Shopify Community,

I’ve created a custom app and I want to install it to a merchant's store programmatically using the API.

Is there a way to automate the installation process (like generating an install link or triggering OAuth) via API, without using the Partner Dashboard?

Any guidance or documentation links would be appreciated.

[mageplaza-cs · Accepted solution]

Hi @Sneha_Subhash 

I am from Mageplaza - Shopify solution expert.

Yes, you can programmatically install a custom Shopify app to a merchant store using the OAuth 2.0 flow, without using the Partner Dashboard for every installation.

While the initial app creation and registration (client ID, secret, etc.) must happen in the Shopify Partner Dashboard, once your custom app is created, you can automate the installation process via OAuth.

Here's How to Automate the Installation Process
Step 1: Generate the App Installation (OAuth Authorization) URL
You can generate the installation URL dynamically for any store using the following format:

https://{shop}.myshopify.com/admin/oauth/authorize?client_id={api_key}&scope={scopes}&redirect_uri={redirect_uri}&state={nonce}&grant_options[]=per-user

Parameters:

• {shop} – Store’s subdomain (e.g., example-store)
• {api_key} – Your app’s API key from the Partner Dashboard
• {scopes} – Required access scopes (comma-separated), e.g. read_orders,write_products
• {redirect_uri} – Where Shopify should redirect after the merchant grants access
• {nonce} – Random string to protect against CSRF
• grant_options[]=per-user – Optional: request online tokens (for logged-in users)

Step 2: Merchant Authorizes the App
You redirect the merchant to the above URL. They will see a prompt to install your app and approve the permissions.

Step 3: Receive Authorization Code (Redirect)
After approval, Shopify redirects to your {redirect_uri} with the following query parameters:

?code={authorization_code}&hmac=...&shop=...&state=...&timestamp=...

You validate the hmac and state, then extract the code.

Step 4: Exchange the Authorization Code for an Access Token
Make a POST request to:

POST https://{shop}.myshopify.com/admin/oauth/access_token

With body:

{
  "client_id": "your-api-key",
  "client_secret": "your-api-secret",
  "code": "authorization_code"
}

Response:

{
  "access_token": "",
  "scope": "read_orders,write_products"
}

Now you can use this access_token to make authenticated calls to that merchant's store.

Automating Installation Across Stores
You can script the entire process up to step 2:

• Dynamically generate the install URL based on the {shop} input.
• Redirect or send the merchant that link.

Manual interaction is still required once per store, as Shopify does not allow silent installation due to security and privacy compliance (GDPR, etc.).

What You Cannot Do via API:

• Auto-install the app without merchant interaction
• Skip the OAuth screen
• Bypass permission confirmation (this must be user-approved)

Please let me know if it works as expected!

Best regards!