app-auth

Shopify App Authentication

Shopify provides multiple authentication flows depending on your app type and use case. The modern standard is Token Exchange (2024+) for server-rendered apps, Managed Installation for headless apps, and OAuth 2.0 Authorization Code Grant for legacy/custom implementations. All flows result in an access token for the Shopify GraphQL Admin API.

Authentication Flows Overview

1. Token Exchange (Recommended for 2024+)

Use Case: Server-rendered apps (Remix, Next.js with SSR), Shopify CLI apps Flow: Merchant installs app → Shopify generates temporary exchange token → App exchanges for access token Security: No client secret exposed; uses PKCE-style rotation per request Token Lifetime: Access tokens are short-lived; refresh tokens rotate automatically

Token Exchange Diagram:

1. Merchant clicks "Install" in Shopify Admin
2. Shopify redirects: https://your-app.com/auth/callback?code=EXCHANGE_TOKEN
3. App validates HMAC, exchanges code for access token (private, server-side only)
4. Shopify Admin API grants scopes; token stored in session/database
5. Token auto-refreshes on next request if expired

Remix Implementation (Token Exchange):

// shopify.app.ts (App Configuration)
import { shopifyApp } from '@shopify/shopify-app-remix/server';
import { restResources } from '@shopify/shopify-api/rest/admin/2026-07';
import { PrismaSessionStorage } from '@shopify/shopify-app-session-storage-prisma';
import { prisma } from '~/db.server';

const shopify = shopifyApp({
  apiKey: process.env.SHOPIFY_API_KEY || '',
  apiSecret: process.env.SHOPIFY_API_SECRET || '',
  scopes: process.env.SCOPES?.split(',') || [
    'write_products',
    'read_products',
    'write_orders',
    'read_orders',
    'write_customers',
    'read_customers',
    'write_discounts',
    'read_discounts',
    'write_fulfillments',
    'read_fulfillments',
    'write_inventory',
    'read_inventory',
  ],
  appUrl: process.env.SHOPIFY_APP_URL || 'http://localhost:3000',
  auth: {
    path: '/auth',
    callbackPath: '/auth/callback',
  },
  webhooks: {
    path: '/webhooks',
  },
  isEmbeddedApp: true, // Polaris admin dashboard
  sessionStorage: new PrismaSessionStorage(prisma),
  restResources, // Includes REST API helpers
});

export default shopify;