shopline-oauth

SHOPLINE App Authorization & Request Signing

Two separate things are often confused: (1) OAuth for obtaining store access tokens (public/custom apps), and (2) HMAC-SHA256 request signing required on OAuth HTTP calls and webhook callbacks. Private apps skip OAuth entirely — the token is copied from the SHOPLINE Admin.

OAuth 2.0 authorization code flow (public & custom apps)

Step 1 — install request. When a merchant installs the app, SHOPLINE GETs your App URL with query params handle (store handle), timestamp (ms), sign (signature), plus lang if embedded. Verify the signature first (see below).

Step 2 — authorize. Redirect the merchant (or give them the URL):

GET https://{handle}.myshopline.com/admin/oauth-web/#/oauth/authorize?appKey={appKey}&responseType=code&scope={scope}&redirectUri={redirectUri}

• scope: comma-separated permission points, e.g. read_products,read_orders
• redirectUri: must exactly match a callback URL configured in the Partner Portal (URL-encoded)

Step 3 — callback. SHOPLINE redirects to your redirect URI:

GET https://{redirectUri}?appkey={appkey}&code={code}&customField={customField}&handle={handle}&timestamp={timestamp}&sign={sign}

The code is an OAuth authorization code, valid 10 minutes. Verify sign before using it.

Step 4 — exchange code for token:

POST https://{handle}.myshopline.com/admin/oauth/token/create
Content-type: application/json
appkey: {appkey}
timestamp: {timestamp}
sign: {sign}

{"code":{code}}

Response: {"code":200,"i18nCode":"SUCCESS","data":{"accessToken":"...","expireTime":"...","scope":"..."}}. The access token is valid 10 hours.

Step 5 — refresh before expiry:

POST https://{handle}.myshopline.com/admin/oauth/token/refresh
Content-type: application/json
appkey: {appkey}
timestamp: {timestamp}
sign: {sign}

(no body). After refresh, the old token stays valid for 5 minutes, then dies.

Request signing (HMAC-SHA256)