I recently submitted my first Shopify application for review. It is an unlisted app, and is meant to be used as an in-house tool, and doesn’t actually have a registration flow. It got denied because apparently the OAUTH must first be triggered before the app is event installed/used. However, since …

I think the only thing you got wrong is the actual user flow you expect. When a user accesses your App via an URL, they do not LOGIN to your App, instead, they provide the shop name so you can initiate oAuth. That is where you made a mistake I think. If you want people to login to your App, separate…

All Apps have a registration flow, private, custom, unlisted or public. Nothing changes there. You have to do oAuth to register a store in your App. It makes sense that if a store does not have your App installed, that the first thing that happens is oAuth. That allows the Shop to know about your Ap…

Thanks for the response here. So the concept of asking for permission via OAUTH makes sense. However, it seems that the way the bot is checking this is: Access app via URL Check to see if OAUTH request is the first thing that it sees But the actual user flow would be something like this: Acces…

Hi, I’m having the same issue. How did you solve it? What URL do you put on the “App URL” input? I have the same user flow and in order to install the Shopify App the users must log in on my platform and then go ahead and link up a Shopify store.

You must separate YOUR App login from anything to do with Shopify. No one cares how you log people in to your App, but there should be zero concern for that coming from the oAuth pattern. You use oAuth to authenticate with Shopify, and that has zero to do with accounts logged into your App. So creat…

So basically I have to create an URL where users can log in to my app through Shopify using oAuth just for the review?

The endpoint you create is not just for the review. No. That would be silly, having to do something just for review. The fact is, you cannot authenticate with Shopify without using oAuth, and the approach to using oAuth means having an endpoint, that initiates oAuth flow. You get that. You provide …

@HunkyBill similar case here: my users log into my application on a unique subdomain (i.e. https://mycompany.app.com ). The Shopify integration isn’t meant to be listed in the App store - the oAuth will be initiated by the user from within our application, after they’ve created an account with us and…

Again. It makes no difference whether an account exists in your App outside Shopify or not. The only that does matter is that you establish the *.msyhopify.com domain name representing the store you wish to connect the user to. So for that, you do oAuth sending that shop name to the oAuth endpoint. …

Thanks for the quick reply - and I don’t mean to bother you with a question that you’ve already answered. But in my case it does make a difference, because I can’t perform the oAuth process on the main ( www.myapp.com ) subdomain. I could certainly redirect to the oAuth endpoint with the shop param t…

OAUTH Flow - Unlisted App

Retired Boards Appdev Billing

mdobrenko March 30, 2021, 4:34pm 5

Ah yep – that was it, 100%. I didn’t realize the difference between someone clicking on the app vs accessing the app via app.whateverapp.com. Figured clicking on the app should just redirect to app.whateverapp.com…

Appreciate it!!

Topic		Replies	Views
Your app must immediately authenticate using OAuth before any other steps occur Shopify Apps third-party-apps	12	459	April 25, 2025
Starting the OAuth flow from an external app Partners Discussion	7	162	December 7, 2022
Issue with App Review for OAuth Flow and Shop URL Requirement Authentication Setting-Up	1	173	January 15, 2024
Issue with public app review in oAuth flow Authentication troubleshooting , Setting-Up	0	61	March 23, 2024
Oauth review failing automatic checks, Please help Shopify Apps	13	180	January 16, 2023

OAUTH Flow - Unlisted App

Related topics