@kody/shopify

docs/auth.md

57 lines · 2.5 KB · Markdown

Shopify auth for this package

Kody does not ship a Shopify OAuth integration for this package. That is intentional. Forkers bring their own Admin credentials.

Lanes

Lane	Secrets	How the client authenticates
Client credentials (preferred)	`shopifyClientId`, `shopifyClientSecret`	`POST /admin/oauth/access_token` with `grant_type=client_credentials`, then `X-Shopify-Access-Token`
Legacy custom app	`shopifyAdminAccessToken`	`X-Shopify-Access-Token: {{secret:shopifyAdminAccessToken}}`

If shopifyAdminAccessToken exists, it wins. Otherwise both client credentials secrets are required.

Client-credentials tokens last 24 hours. This package exchanges a fresh token on each invoke and does not cache it. That keeps the live @kody/shopify package from writing shop tokens into shared storage.

Shop host

Every Admin call goes to:

https://{shop}.myshopify.com/admin/api/{version}/graphql.json
https://{shop}.myshopify.com/admin/api/{version}/{resource}.json
https://{shop}.myshopify.com/admin/oauth/access_token

shop is normalized from acme, acme.myshopify.com, or https://acme.myshopify.com/admin. Other hosts are rejected.

You must approve {shop}.myshopify.com on the secrets you save. Kody host approval is per hostname; there is no wildcard for every shop.

Secret setup URLs

Create secrets in the account UI. Do not paste values into chat.

Official Shopify references

What this package will not do

Register a platform /connect/oauth?provider=shopify app
Ask you to paste a token into an agent chat
Store exchanged access tokens in packageStorage()
Call Storefront, Customer Account, or Payments Apps APIs (add those in a fork if you need them)