Shopify OAuth 2.0: How It Works for Developer Apps
If you have ever installed a Shopify app and wondered what happens in the background during those few seconds between clicking "Install" and landing on the app dashboard, the answer is OAuth 2.0.
If you have ever installed a Shopify app and wondered what happens in the background during those few seconds between clicking "Install" and landing on the app dashboard, the answer is OAuth 2.0. It is the security protocol that governs how third-party apps request and receive permission to access your store's data. Most merchants never think about it — until something goes wrong, a permission request looks suspicious, or a developer app they are evaluating asks for access scopes that seem far broader than necessary.
Understanding OAuth 2.0 is not just a developer concern. As a merchant, you approve these permission requests every time you install an app, and those approvals have real consequences for your store's security, customer data, and compliance obligations. A poorly scoped app can expose your order history, customer emails, or product catalogue to unnecessary risk.
In this post, you will learn exactly how Shopify's OAuth 2.0 flow works, why it matters for your store's security, how to evaluate the permission scopes apps request, and what red flags to watch for when reviewing developer-built integrations. Whether you run a high-volume DTC brand, a B2B wholesale operation, or a niche product store, this knowledge will help you make smarter decisions about the apps you trust with your store.
What OAuth 2.0 Actually Is (and What It Is Not)
OAuth 2.0 is an open authorisation framework — not an authentication system — that allows one application to act on behalf of a user without ever receiving that user's password. In Shopify's context, it means a third-party app can read your orders, write product listings, or trigger fulfilment actions using a temporary, scoped access token rather than your admin credentials. This distinction matters enormously: the app never knows your password, and Shopify remains the gatekeeper for every permission granted.
The protocol was designed specifically to solve the delegation problem. Before OAuth existed, integrating two systems often meant sharing raw credentials, which created enormous security risks. If a connected app was compromised, attackers would have full access to your store. OAuth 2.0 replaces that model with short-lived tokens that can be revoked individually without resetting your entire account. For merchants working with agencies or developers building custom integrations, this architecture is a significant protection.
It is important not to confuse OAuth 2.0 with single sign-on or basic API key authentication. Shopify does support private API keys for certain use cases, but the OAuth 2.0 flow is what powers the public app ecosystem — every app in the Shopify App Store uses it. Knowing this helps you understand why the installation process involves a permission screen rather than a simple download.
The Step-by-Step Shopify OAuth Installation Flow
When you click "Add app" in the Shopify App Store, a precise sequence of events begins. First, Shopify redirects your browser to the app's authorisation URL, appending your shop domain and a unique state parameter — a random string used to prevent cross-site request forgery attacks. The app receives this request and immediately redirects you back to Shopify's OAuth authorisation page, where you see the permission screen listing every access scope the app is requesting.
Once you click "Install app," Shopify generates a temporary authorisation code and sends it to the app's redirect URL. This code is short-lived — typically valid for only 60 seconds — and can only be used once. The app then exchanges this code for a permanent access token by making a server-to-server POST request to Shopify's token endpoint, including its API key and secret. This exchange happens entirely on the server, away from the browser, which means the access token is never exposed in a URL or browser history.
Shopify responds with the access token and the list of granted scopes, which the app stores securely in its own database. Every subsequent API call the app makes includes this token in the request header. As a merchant, you never see this token — but you can revoke it at any time from your Shopify admin under Settings > Apps and Sales Channels, which immediately invalidates the token and cuts off the app's access to your store data.
Understanding Access Scopes: What Apps Are Actually Asking For
Access scopes are the specific permissions an app requests to do its job. Shopify has dozens of them, covering everything from read_orders and write_products to read_customers and write_fulfillments. When you see the permission screen during installation, you are looking at the exact list of scopes that app's developer has declared. A well-built app requests only what it genuinely needs to function — this principle is called least privilege, and it is a meaningful signal of app quality.
Consider the difference between a product review app and an inventory sync tool. A review app should reasonably request read_products and write_script_tags, but it has no legitimate reason to request write_orders or read_customers. If you see a review app asking for order-writing permissions, that is worth questioning before you proceed. Reputable developers document exactly why they need each scope, either in their app listing or in their privacy policy.
For merchants managing stores with sensitive B2B customer data — think enterprise clients like Accenture or Epic Games, who operate at a level where data governance is non-negotiable — reviewing access scopes before installation is not optional, it is a procurement requirement. Even for smaller operations, understanding that read_customers gives an app access to names, emails, and purchase history should prompt you to verify that the app's privacy policy meets your obligations under GDPR or equivalent regulations.
Online vs. Offline Access Tokens: A Practical Difference
Shopify's OAuth system supports two token types, and the difference has direct implications for how an app behaves over time. Online access tokens are tied to a specific staff member's session and expire when that session ends — typically within a few hours. They are appropriate for apps where actions should be attributed to a specific user, like a bespoke admin tool that logs which staff member approved a wholesale order.
Offline access tokens do not expire and are not tied to any individual session. They persist until you manually revoke them, which is why they power the vast majority of automated integrations — sync tools, fulfilment services, marketing platforms, and AI-powered apps that need to operate in the background without a user being logged in. When you install an app that continues working overnight, processing orders or updating inventory, it is using an offline token.
As a merchant, you should periodically audit the apps holding offline tokens to your store. In your Shopify admin, go to Settings > Apps and Sales Channels and review every connected app. If you see apps you no longer actively use, uninstalling them revokes their tokens immediately. This is basic store hygiene — a token to a defunct integration is an unnecessary attack surface, even if no one is actively exploiting it. Building a quarterly review habit takes less than fifteen minutes and meaningfully reduces your store's exposure.
Security Best Practices When Evaluating Developer Apps
Not all apps in the Shopify ecosystem go through the same level of scrutiny, and custom or unlisted apps built by freelance developers carry different risk profiles than vetted App Store listings. When a developer sends you an installation link for a custom app, verify that the redirect URI in the OAuth flow points to a domain you recognise and that the developer has provided documentation explaining each requested scope. Never install a custom app from an installation link sent via informal channels like WhatsApp or personal email without that verification.
For stores using SaltAI Agent for Shopify, the OAuth implementation follows Shopify's recommended security patterns — including HTTPS-only redirects, state parameter validation, and server-side token storage. These are not optional extras; they are the baseline any app handling merchant data should meet. When evaluating any developer tool, ask directly whether it validates the state parameter and how it stores your access token. A developer who cannot answer those questions clearly is a developer whose code you should scrutinise further.
You should also consider what happens when an app vendor is acquired, goes out of business, or changes its terms of service. Revoke tokens promptly in those situations. Shopify does not automatically revoke tokens when an app is removed from the App Store — only uninstalling the app from your admin does that. Keeping your app connections clean is as important as any firewall or two-factor authentication measure you apply to your admin account.
Common OAuth Mistakes Merchants Should Know About
One of the most common misunderstandings merchants have is assuming that because an app came from the official Shopify App Store, it has carte blanche to access their data responsibly. Shopify reviews apps for functionality and policy compliance, but it cannot audit every line of code or guarantee that a developer handles your data in accordance with your specific compliance requirements. The OAuth flow gives you a moment of transparency — the permission screen — and merchants who skip reading it are missing their primary control point.
Another frequent mistake is installing multiple apps that request overlapping write permissions for the same resources. If three separate apps all hold write_products tokens, any one of them can modify your entire product catalogue. This is not hypothetical: there are documented cases of conflicting apps overwriting each other's changes, causing inventory discrepancies that took days to untangle. Mapping which apps hold which write permissions, and ensuring no two apps are writing to the same resource unless deliberately designed to work together, prevents a class of integration problems before they start.
Finally, merchants sometimes conflate revoking an app's token with deleting their data from that app's servers. Revoking a token stops future access but does not delete the data the app has already collected. For data deletion, you need to consult the app's privacy policy and submit a deletion request directly to the developer. This is particularly relevant for customer data under GDPR, where the right to erasure applies to data held by third-party processors as well as to your own Shopify store.
Conclusion
OAuth 2.0 is the invisible infrastructure that makes Shopify's app ecosystem both powerful and, when used correctly, secure. Understanding the installation flow, the difference between token types, and the meaning of access scopes puts you in a far stronger position as a merchant — whether you are reviewing a custom developer build, auditing your existing app stack, or simply trying to understand why an app is asking for permissions that seem excessive.
The key takeaways are straightforward: read permission screens before clicking install, audit your connected apps quarterly, understand the difference between online and offline tokens, and verify that any developer-built integration follows Shopify's security requirements. These habits take minimal time and provide meaningful protection for your store, your customers, and your data.
Try SaltAI Agent for Shopify free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.