OAUTH Flow - Unlisted App

Thanks - for others coming along here, here’s how I’m dealing with this:

  1. Receive request from the Shopify App store: www.mydomain.com?shop=usershop.myshopify.com&hmac=1234567

  2. Initial the oAuth request, passing the shop domain

  3. Capture the oAuth credentials response, save the token to the DB (without tying it to any of my users, since I don’t know who’s logged in yet)

  4. Ask the user to log in

  5. Once logged in, associate the previously saved token to the now logged in user.