App reviews, troubleshooting, and recommendations
We created a Shopify payment App, and we already set the scope as follows in our PHP code
$scopes = 'write_payment_gateways,write_payment_sessions,write_orders,write_products,write_customers';
<?php
require_once("inc/config.php");
// Set variables for our request
$shop = $_GET['shop'];
$scopes = 'write_payment_gateways,write_payment_sessions,write_orders,write_products,write_customers';
$redirect_uri = 'https://hostedwebsites.com/shopify-app/oauth-token.php';
// Build install/approval URL to redirect to
$install_url = 'https://' . $shop . '/admin/oauth/authorize'
. '?client_id=' . $api_key
. '&scope=' . $scopes
. '&redirect_uri=' . urlencode($redirect_uri)
. '&state=st'.rand(5, 1000)
. '&grant_options[]=per-user';
// Redirect
header('Location: ' . $install_url);
Now, when we try to call GraphQL API mutation PaymentsAppConfigure, we are always getting "You do not have permission to access this website"
<?php
// Get $api_key & $shared_secret from config.php
require_once("inc/config.php");
$params = $_GET; // Retrieve all request parameters
$hmac = $_GET['hmac']; // Retrieve HMAC request parameter
$params = array_diff_key($params, array('hmac' => '')); // Remove hmac from params
ksort($params); // Sort params lexographically
$computed_hmac = hash_hmac('sha256', http_build_query($params), $shared_secret);
// Use hmac data to check that the response is from Shopify or not
if (!hash_equals($hmac, $computed_hmac)) {
die('Error: invalid authentication!');
}
// Validate request is from valid shopify website
if (!preg_match("/\A[a-zA-Z0-9][a-zA-Z0-9\-]*\.myshopify\.com\z/", $_GET['shop'])) {
die('Error: invalid Shop!');
}
// Set variables for our request
$query = array(
"client_id" => $api_key, // Your API key
"client_secret" => $shared_secret, // Your app credentials (secret key)
"code" => $params['code'] // Grab the access key from the URL
);
// Generate access token URL
$access_token_url = "https://" . $params['shop'] . "/admin/oauth/access_token";
// Configure curl client and execute request
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $access_token_url);
curl_setopt($ch, CURLOPT_POST, count($query));
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($query));
$result = curl_exec($ch);
curl_close($ch);
// Store the access token
$result = json_decode($result, true);
error_log(PHP_EOL . date('d.m.Y h:i:s') . ' - ' . 'access token: ' . print_r($result, 1), 3, 'test.log');
if (!empty($result['access_token'])) {
// Should call an API to connect the payment app !!!
// https://{shop_domain}/payments_apps/api/2021-07/graphql.json
$url = 'https://' . $params['shop'] . '/payments_apps/api/2021-07/graphql.json';
$queryArr = [
'query' => 'mutation PaymentsAppConfigure($externalHandle: String, $ready: Boolean!) {
paymentsAppConfigure(externalHandle: $externalHandle, ready: $ready) {
paymentsAppConfiguration {
externalHandle
ready
}
userErrors{
field
message
}
}
}',
'variables' => [
'externalHandle' => 'API_token_key',
'ready' => true
]
];
$query = json_encode($queryArr);
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-Shopify-Access-Token:' . $result['access_token'], 'Content-Type: application/json'));
$result = curl_exec($ch);
$err = curl_error($ch);
curl_close($ch);
echo "<pre>";
// print_r($err);
print_r($result);
die;
} else {
die('Error: No response!');
}
Moreover, we tried to install GraphQL APP, and called the same mutation. We got "message": "PaymentsAppConfigure access denied",
Meanwhile, when calling any rest API using the same code or even using GraphQL, we got a successful response.
We need to know, Is there any extra scope that should be added in our Payment App implementation or we should have specific permission from Shopify partner account??
Hi,
did you get it to work?
I don't know what the value should be for "externalHandle".
I notice you are using "API TOKEN", does it work?
Thanks,
Hii @Nermeen ,
This page will help you get up and running with Shopify’s GraphQL API.
https://shopify.dev/api/admin-graphql#top
Thank You.
There are two scenarios which cause the below error.
@Nermeen are you able to resolve error ? Facing same issue graphql mutation is working from postman and not working from PHP code
Hello @khushbu1990,
It's fixed by adding CURLOPT_USERAGENT in the CURL request as below:
$ch = curl_init();
$userAgent = $_SERVER['HTTP_USER_AGENT'];
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-Shopify-Access-Token:' . $result['access_token'], 'Content-Type: application/json'));
curl_setopt($ch, CURLOPT_USERAGENT, $userAgent);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$result = curl_exec($ch);
Thanks @Nermeen It's working now. I would like to know that what is the purpose to send user agent and i have gone through all documentation of shopify but didn't find anything.
That's great!
It seems that Shopify graphQl doesn't accept requests without userAgent in the CURL header, That's why it returns 403 forbidden access. Moreover, there is no clear information regarding this point in the Shopify documentation.
Have a nice day!
Thanks @Nermeen For information
Yes 100 % agree with you. There is no proper documentation on this
Hi @Nermeen we were also facing the same issue, as per your comment we tried and added the user agent in the curl request. However, we are still getting this error.
Some one has resolved the "message": "PaymentsAppConfigure access denied"?
How can I validate if payments permissions were granted?
We recently spoke with Zopi developers @Zopi about how dropshipping businesses can enha...
By JasonH Oct 23, 2024A big shout out to all of the merchants who participated in our AMA with 2H Media: Holi...
By Jacqui Oct 21, 2024We want to take a moment to celebrate the incredible ways you all engage with the Shopi...
By JasonH Oct 15, 2024