Oauth on external application (using keycloak)

Shopify Apps
,
1

Hello everybody,
I am actually working on a shopify application (work is well advanced and the application is being submitted).

To summarize, this application is a bridge that allows users of a SaaS application (from the company I work for) to publish products to those users’ Shopify stores.
To simplify account association between SaaS app and any Shopify Stores I have add a form (in the SaaS where the user is logged) to enter the shop url and proced to a shopify store oauth.
And I associate a token of this shop in the finalise callback url process.

Unfortunately I just get a message from submission process that refused our app because of:
Apps must be installed and initiated only on Shopify services. Your app must not request the manual entry of a myshopify.com URL or a shop’s domain during the installation or configuration flow.

Question 1:
I think the only way to realise the association is to process to a OAuth from the shopify App admin view I develop.
The SaaS application use keycloack engine to manage authentication.

Do you have any suggestions, helps, advices, example about my use case?

Question 2:
If I have to process the oauth on my keycloak from the admin can I use a pop. I read this:
But I read this on the Setup and mechant workflows https://shopify.dev/docs/apps/launch/app-requirements-checklist#c-setup-and-merchant-workflows
but it seem facebook app use a pop up to do it.

Question 3:
I don’t really need the sjopify application admin page but I configured the application as an embedeed app.
My question is,
if I switch the shopify app configuration as a standalone app is this rules always applicable ? I mean as there is no admin embeded page the only way to configure the app is the process I already did.

Question 4:
Since the user is logged, it can publish from our SaaS on his shopify shop. This is risky to publication process.

Best regards
Max

2

Hello @Jean-Maxime

You’ve raised a number of important questions regarding Shopify’s OAuth and app requirements—especially as they relate to integrating a SaaS app with Shopify stores using Keycloak for authentication. Let’s go through them one by one:

Question 1: Shopify OAuth Flow & Keycloak Integration
“I think the only way to realise the association is to process to a OAuth from the shopify App admin view I develop.”

You’re absolutely right in diagnosing the problem. Shopify does not allow apps to initiate installation from outside Shopify’s ecosystem, and that includes asking the user to manually enter their myshopify.com domain.

Correct Approach:

. The OAuth flow must be initiated from Shopify’s App Store, or by clicking “Install app” in the Shopify Admin.

. Once the user installs the app via Shopify, your app will receive the OAuth callback with the shop domain and authorization code, and you can then establish the association between your SaaS user and that Shopify store (e.g., by linking to the Keycloak user).

Key recommendation:
Let the OAuth originate from Shopify, but link the store to your SaaS account after installation. You can achieve this by:

. Using JWT tokens or signed sessions that track which Keycloak user initiated the installation.

. Or after installation, require the user to log in to your SaaS app from within the embedded app, so you can complete the binding.

Question 2: Can I Use a Popup to Connect the SaaS User (Keycloak)?
“Can I use a popup to authenticate the user on Keycloak from the Shopify app?”

Yes, embedded apps often use pop-ups to authenticate with third-party services, including Google, Facebook, and yes, even your own Keycloak login.

In fact, this is the recommended way to avoid full-page reloads or redirect conflicts in embedded Shopify apps.

Use case flow example:

  1. Shopify merchant installs the app from Shopify.

  2. Your embedded app opens and checks if the user is authenticated with your SaaS.

  3. If not, you show a “Connect your account” button that opens a popup to your Keycloak login.

  4. Once Keycloak login is complete, the popup closes and the parent window is updated with the user session.

So yes, using a popup for Keycloak is acceptable.

Question 3: What If My App Is Not Embedded?
“If I switch to a standalone app, is the domain-entry rule still applicable?”

Yes. Even for standalone (non-embedded) apps, you are still not allowed to prompt the user to enter their shop domain manually.

Shopify wants app installation to happen through their ecosystem to ensure trust and consistency. You can’t prompt a user for their store URL just to kick off installation—you must link to Shopify’s install route.

The correct way (whether embedded or standalone):

. Link to:

https://{shop}.myshopify.com/admin/oauth/authorize?client_id=...&scope=...&redirect_uri=...

where {shop} is inferred from the Shopify App Store install or from Shopify redirecting to your app—not manually entered by the user.

Question 4: Is It Risky to Let the SaaS Publish Directly to Shopify?
“Since the user is logged, it can publish from our SaaS on his Shopify shop. This is risky to publication process.”

You’re touching on a very important security and user control concern.

If your app allows a logged-in SaaS user to push data to a connected Shopify store, make sure:

  1. The OAuth token is stored securely and associated with the right Keycloak account.

  2. The user has visibility and control over which Shopify store they are publishing to.

  3. You implement rate limiting, validation, and a user interface that clearly shows the destination and outcome of publishing actions.

  4. Ideally, your app should include audit logs so users know what content was pushed, when, and by whom.

Otherwise, yes, it could be risky—especially if account takeovers happen in your SaaS app.

Summary of Actions:
. Remove any UI where the user manually enters their myshopify.com domain.

. Start OAuth only from a proper Shopify-initiated route.

. Use a popup for Keycloak login inside your embedded app, not for Shopify install.

. You’re fine using a non-embedded app, but the rule about no manual domain entry still applies.

. Make sure publishing actions from SaaS to Shopify are secure, transparent, and auditable.

Thank you :blush:

3

Hello goldi07,
Before all thanks a lot for these very precise answers !

For the answer 2, it is what I want to do but I ask because I read in the checklist of requirements than it is striclty forbiden to open a popup for oauth (screen bellow):

JeanMaxime_1-1746452607052.png
JeanMaxime_1-1746452607052.png1345×512 90.5 KB

For the answer 4, my question was more about the submission. I mean it will be blocking us if the only feature of our app is on our SaaS side ?
Otherwise thanks for the advices about security.

4

Ok wait

5

thank you for the clarification and screenshot. Let’s break this down further based on your follow-up and what’s shown in the Shopify app checklist section C. Setup and merchant workflows.

Regarding popups for OAuth (Answer 2):
You are correct to question this line:

“Your app must not use pop-up windows for essential app functionality, like running OAuth or approving app charges.”

Here’s what it actually means:

. This rule is about Shopify’s own OAuth flow (i.e., the installation of your Shopify app).

. It does not forbid using a popup to connect your own SaaS (e.g. Keycloak auth).

So:
You cannot use a popup to initiate Shopify’s OAuth flow.
You can use a popup inside your Shopify embedded app to authenticate the user with Keycloak, since that is not essential Shopify functionality, but a third-party auth within your embedded context.

This is exactly what Facebook, Google, and other identity providers do in embedded apps.

Regarding Answer 4 – Submission blocker if all features are SaaS-side:
This can be a blocker.

From Shopify’s standpoint:

. Your app must offer some actual value or UI inside Shopify, even if it’s just basic configuration, logs, sync status, or settings.

. If all functionality is in your SaaS, and the Shopify app is just a shell to authenticate + store tokens, it will likely get rejected during review.

Suggestions to pass review:
. Include a dashboard page within the embedded app (even if minimal).

. Show “Connected Account”

. Show “Products Synced” or last sync date/time

. Add a “Sync now” or “Manage connection” button

. Provide some feedback or visibility to the merchant from inside the Shopify admin—even if all the heavy work happens externally.

Even apps that primarily push data into Shopify (e.g., print-on-demand, or CMS-to-Shopify connectors) offer something in their embedded admin interface.

Summary:

Item Allowed / Not Allowed

Popup for Shopify OAuth/install Not allowed

Popup for Keycloak login inside embedded app Allowed

Only SaaS-side features, no Shopify UI Risk of rejection

Minimal embedded app UI (status/logs/settings) Required for approval

Thank you :blush: