The Shopify–Ory OAuth2 sign-in reaches the authorization-code callback, but Shopify fails when exchanging the code for tokens. Initial guidance focused on checking Ory client settings, including client_secret_basic authentication, matching client secret and callback URL, authorization-code and refresh-token grants, and the required scopes. The reported configuration appeared correct, but a later error clarified the immediate failure: Shopify’s token-endpoint request timed out (Net::ReadTimeout).
The current diagnosis is therefore a response-time or connectivity issue, not proof of incorrect credentials. Shopify requires the token, discovery, and userinfo endpoints to respond within one second. Recommended next steps are to repeat a fresh connection test, record its UTC timestamp, and check Ory logs for whether the token request arrived, its status, and its duration; if it did not arrive, inspect network, proxy, or firewall routing. The endpoints should also be timed from outside the local network, including repeated checks for a slow first request. Shopify Support can be asked to trace the request ID alongside the timestamp and endpoint URL. No root cause or resolution has yet been confirmed.
I’m experiencing an issue while integrating Shopify with Ory using OAuth2 authentication.
During the authentication process, I encounter the following error:
The error appears during the OAuth2 authentication flow when attempting to obtain an access token.
Could you please investigate this issue and help identify the root cause? Specifically, I’d appreciate guidance on whether this is related to the OAuth2 client configuration, token exchange, redirect URI, or another integration issue.
Hi! Assuming you’re connecting Ory as your own identity provider for customer accounts (Settings > Customer accounts > Identity provider, Shopify Plus only), that page is Shopify’s own error screen.
“Access token request error” means the first half of the sign-in worked: Ory logged the user in and sent the authorization code back to Shopify’s callback. The part that fails is the next step, where Shopify swaps that code for tokens at Ory’s token endpoint, server to server. So it’s almost always the OAuth2 client configuration, not the login page.
What I’d check, in this order:
Client authentication method. Shopify authenticates at the token endpoint with client_secret_basic (client ID + secret in a Basic auth header). If the Ory OAuth2 client is set to client_secret_post or none, Ory rejects the exchange. Open the client in the Ory Console and set it to client_secret_basic.
Client secret. Make sure the secret saved in Shopify (Identity provider > Application info) is the current one for that exact client, in the same Ory project. If it was regenerated or copied with a stray space, the exchange fails the same way. Paste it again and click Save.
Grant and response types. The client must allow the authorization_code grant with response type code. Add the refresh_token grant too (and allow the offline_access scope); without a refresh token, customer sessions end when the access token expires instead of lasting up to 90 days.
Callback URL. The redirect URI on the Ory client must be exactly the Callback URL from Shopify’s Setup configurations section (same domain and path, no trailing slash). It’s sent again in the token request and has to match.
Scopes.openid and email must both be allowed on the client. Those are the two Shopify requested in your error.
Two quick sanity checks:
Open https://<your-ory-project-domain>/.well-known/openid-configuration. token_endpoint_auth_methods_supported should include client_secret_basic, and issuer should match the domain you gave Shopify (a custom domain vs the default Ory project URL is an easy mismatch).
Shopify needs the token, discovery and userinfo endpoints to answer within 1 second, or the sign-in times out.
Once the exchange works, the ID token also needs sub, email, email_verified: true, nonce, iss and aud, signed with RS256/ES256 or similar (HS256 isn’t accepted). Then use Test connection again.
The configuration looks good on our end. However, the initial attempt timed out, and subsequent tries resulted in an access token error.
I would have been really helpful if there some way we could inspect the error based on request id and know what the actual issue was
Couldn’t confirm identity.
Couldn’t reach your identity provider’s token endpoint: Net::ReadTimeout with #HTTPHostRestriction::RestrictedTCPSocket:(closed).
Verify your identity provider is online and the token endpoint is publicly accessible. If intermittent, it may be a network issue.
Request ID: e3a74e23-22ae-45bc-9230-3f8fed817a5f-1793257188
@ashish.poudel Your latest error narrows this down: Net::ReadTimeout means Shopify timed out waiting for a response from the token endpoint. It doesn’t establish that your client credentials are wrong.
The next step is to correlate one fresh Test connection attempt with your Ory logs. Record the UTC timestamp, then check whether the token POST arrived, its response status and duration.
If it arrived but responded slowly, investigate that latency first. Shopify requires a response within one second, so an exchange that eventually succeeds can still fail Shopify’s test.
If there’s no matching request, check any proxy or firewall logs and verify the advertised token endpoint is publicly reachable.
For your request ID question, send Shopify Support that ID, timestamp and endpoint URL, asking them to trace the failed exchange. Keep secrets and tokens private. Those paired logs should distinguish endpoint latency from an access or routing problem.
Thanks for the update, @ashish.poudel. @alaattincagil has read it right: Net::ReadTimeout means Shopify gave up waiting for a response, so this is now about how fast your Ory endpoints answer rather than the client settings from my earlier reply.
One thing to add: Shopify’s 1-second limit doesn’t only apply to the token endpoint. It covers the discovery and userinfo endpoints too, and any of the three timing out fails the sign-in. So when you test, time all three, not just the token call.
A quick check you can run from outside your own network (repeat it a few times):
If the first call is clearly slower than the ones after it, that warm-up delay would explain why your first attempt timed out. Anything near or above 1 second on a normal call means the endpoint needs to respond faster (or be hosted closer / with more capacity) before Shopify will accept it.