Hey everyone, I’m Yousuf Qadri, a developer working on a Shopify app that’s currently under review. I wanted to share some details about our implementation and get some clarity regarding an issue we’re facing with the OAuth flow, particularly around the {shop} parameter.
We’re building a multi-platform system involving three interconnected apps:
-
Our ad-panel is where brands sign up and initiate the process of connecting their Shopify store.
-
A custom Shopify app that gets installed on the merchant’s store, which we use to fetch products, collections, and orders using an offline access token.
-
A mobile iOS app for influencers and shoppers, which uses UTM-based links to redirect users to the appropriate Shopify product pages.
When a brand signs up on our ad-panel and clicks “Connect to Shopify,” we initiate the OAuth flow. However, at that point, we don’t know which Shopify store they want to connect. Because of this, we are unable to structure the URL in the format https://{shop}.myshopify.com/admin/oauth/authorize?.. as suggested in the Shopify documentation. We simply don’t have the {shop} value at that stage.
Instead, we redirect the brand to Shopify’s centralized OAuth page:
https://admin.shopify.com/admin/oauth/authorize?..
Once the user logs in and selects the store, Shopify completes the OAuth process and returns the authorization code along with the store details. We use the state parameter to pass our internal brandId so we can associate the returned token with the right account on our platform. This is the only secure and dynamic way to handle store selection in our use case, and it works well when we test it on our side.
However, the Shopify review team appears to be installing the app on their own test stores that are not listed as development stores in our Partner Dashboard. As a result, although the app installation succeeds, the offline token generated does not have permission to access Admin APIs (e.g., fetching products or orders). API requests using these tokens fail with an “Invalid API key or access token” error. This issue doesn’t occur when the app is installed on our registered dev stores.
We’ve confirmed this by testing tokens, capturing responses, and recording our own video demonstrations. Shopify support also shared a screen recording, and from what we can tell, they may be installing the app on stores not included in our approved development list, which likely explains the token issue.
One possible solution we’re exploring is giving Shopify access to our test stores by creating a dedicated Shopify account that has access to stores already whitelisted in our Partner Dashboard. That way, they can test the full OAuth and data-fetching flow as intended.
Alternatively, if Shopify could provide the names of the stores being used during the review, we could temporarily add those to our development store list to ensure the tokens they generate have the required privileges.
We’ve already explained this flow multiple times in support conversations, but we’d really appreciate any further input or clarification from others in the community who might have run into similar review roadblocks, especially when not having the {shop} value at the start of the OAuth process.
Thanks in advance for any support or suggestions you can share.
Best regards,
Yousuf Qadri