Shopify authentication from custom server

Retired Boards Appdev Customers Discounts And Orders

Topic summary

A developer is seeking to implement server-side authentication for Shopify similar to WordPress’s wp_authenticate() function.

Current Setup:

  • They operate a webservice that provides resources to users who purchase from their WordPress store
  • Their webservice handles all end-user communication
  • WordPress authenticates users via wp_authenticate() and returns a customer_id upon success

Goal:

  • Replicate this authentication pattern with Shopify accounts
  • Enable their custom server to authenticate users directly against Shopify

Challenge:

  • Based on Shopify documentation review, authentication appears limited to OAuth flows initiated by the end user
  • No equivalent server-to-server authentication API seems available
  • The developer questions whether they’re missing a Shopify API endpoint or if this limitation is intentional

Status: The question remains unanswered, with the developer acknowledging there’s likely a security reason for Shopify’s authentication approach.

Summarized with AI on November 21. AI used: claude-sonnet-4-5-20250929.
1

Hi,

We have a webservice, that can provide certain resources when a user has bought them in our Wordpress based store.

All communication from the end user is done through this webservice. During authentication, the webservice passes on the user credentials to Wordpress, which will authenticate using a php function, and provide customer_id when successful.

https://developer.wordpress.org/reference/functions/wp_authenticate/

I would like to implement this strategy for a shopify account. But from what I have read in the docs, it seems that authentication is only allowed by the end user itself (OAuth), but not between a custom server and shopify.

There is probably a good reason for it :slightly_smiling_face:

Am I right in this summary, or am I missing some shopify API somewhere? Basically I’m looking for something like the wp_authenticate above.

Thanks in advance,

Corjan