Auth flow drops into a different store to the URL you specified

Retired Boards Appdev Authentication

Topic summary

Authentication via a Shopify Partner login intermittently redirects to a different store than the one entered, creating a risk of unintended changes.

Observed behavior (past month+):

Impact:

  • While setting up a new store and connecting a theme via the GitHub integration, a blank theme was accidentally published to the wrong (development) store. The same mistake on a live store could be severe.

Context/terms:

  • Partner login: a Shopify Partner account with access to multiple stores.
  • GitHub integration: links a theme repository to a store, enabling publish actions from the connected theme.

Support response:

  • Attributed the issue to browser cookies and advised caution; no fix provided.

Status and open questions:

  • Unresolved. Root cause unknown beyond “cookies.”
  • No safeguards currently prevent cross-store redirection after auth or confirm store context before theme publishing.
Summarized with AI on December 30. AI used: gpt-5.
1

Over the past month or so, I’ve found that the authentication flow when using a partner login sometimes loads a store which is different to the one that I specified.

For example, the occurrance that just happened:

  • I went to the URL of ‘store-one.myshopify.com/admin’

  • I was presented with the login screen, of which I select the partner account

  • The login screen weirdly reloaded again and I selected the partner account again

  • Login was successful and I was dropped into the admin of ‘store-two.myshopify.com’

Previously I thought this was purely an annoyance that I dealt with. However the other day I was setting up a new store and was connecting the theme via the github integration. The theme connected and I pressed publish. A short while later I noticed I was on the wrong store and I had published a blank theme to that store.

Luckily this wrong store was also in development and not live. It could have very easily been a live store though. I probably would have noticed a live store’s theme in the thumbnail preview, but it’s still not ideal.

I contacted support to raise the issue and they passed it off as cookie issues and effectively told me to be careful.

The fact that I can type in one store’s address and land in another and start making changes without realising is a pretty massive risk as you’re not expecting it. I’m not trying to come of as someone just complaining, but I think some attention should be drawn to it.