OAUTH Flow - Unlisted App

Retired Boards Appdev Billing
3

Thanks for the response here.

So the concept of asking for permission via OAUTH makes sense. However, it seems that the way the bot is checking this is:

  1. Access app via URL
  2. Check to see if OAUTH request is the first thing that it sees

But the actual user flow would be something like this:

  1. Access app via URL
  2. Login to the app, and then navigate to a ‘connect my store’ function
  3. Specify the myshopify URL so that we know which store to generate the OAUTH request for
  4. Once they click a ‘connect’ button, they get redirected to OAUTH and grant (or deny) permission to get their store data

It seems like the Shopify review bot is coming from some ‘install app’ URL, when this will never be a part of the actual flow in production for an unlisted app?