Skip to main content

Shopify OAuth callback (public)

GET 
/api/shopify/oauth/callback

Where Shopify redirects the browser after consent (must equal SHOPIFY_REDIRECT_URI). Trust is Shopify's signed query (hex HMAC with the client secret) plus the single-use state parked by startShopifyOAuth. The code is exchanged for an EXPIRING offline token. Always redirects to the panel's Shopify page with shopify=connected or shopify_error=<missing_params|signature|expired|store_mismatch|exchange|scopes|store_taken>.

Request​

Responses​

Back to the panel.