What is OAuth / authentication for Shopify Apps?

What is Authentication?

Authentication is the process of verifying who you are.

Think of it like entering a building:

• You show your ID → the building verifies you.
• If your ID is valid → you're allowed in.

In software, authentication answers:

“Who is this user/app?”

For example, when you log in to Shopify, Shopify authenticates you using your login credentials and other security mechanisms.

---

What is OAuth?

OAuth (Open Authorization) is a standard that lets one application access another application's resources without asking the user for their password.

For Shopify apps, OAuth is especially important because your app needs permission to access a merchant's Shopify store.

For example:

Merchant's Shopify Store
        ↓
      Shopify
        ↓
   "Do you allow this app
    to access your products?"
        ↓
       YES
        ↓
Your Shopify App

The app receives an access token that it can use to make authorized requests to Shopify.

---

Authentication vs Authorization

These two terms are easy to confuse.

Concept	Question	Example
Authentication	Who are you?	"You are the store owner."
Authorization	What are you allowed to access?	"This app can read products."

A simple way to remember:

Authentication = Who are you? Authorization = What can you access?

OAuth is primarily an authorization framework, although in real applications OAuth/OIDC-related flows can also be involved in establishing identity.

---

OAuth in a Shopify App

Suppose you build an app called Product Manager.

A merchant installs your app on their Shopify store.

Step 1 — Merchant starts installation

The merchant visits your app.

Your app sends them to Shopify's authorization page.

Your App
   ↓
Shopify Authorization Page

---

Step 2 — Shopify asks for permission

Shopify shows something like:

Product Manager wants permission to read and manage products.

The merchant chooses Install/Allow.

Merchant
   ↓
"Allow"

---

Step 3 — Shopify redirects back to your app

After approval, Shopify redirects the merchant back to your app with an authorization code.

Conceptually:

Shopify
   ↓
Your App
   ↓
authorization code

The code is temporary and isn't normally what your app uses for subsequent API calls.

---

Step 4 — Your server exchanges the code

Your app's backend sends the authorization code to Shopify and requests an access token.

Authorization Code
        ↓
Your Backend
        ↓
Shopify
        ↓
Access Token

---

Step 5 — Your app stores the access token

Your backend securely stores the token associated with that Shopify store.

For example:

shop: example-store.myshopify.com

access_token: ********

Never expose an access token in frontend JavaScript, URLs, GitHub repositories, or logs.

---

Step 6 — Your app can call Shopify APIs

Now your backend can use the access token to make API requests that the merchant authorized.

For example:

Your App
   ↓
Shopify Admin API
   ↓
Products
Orders
Customers
etc.

Exactly what it can access depends on the scopes/permissions granted to the app.

---

What is an Access Token?

An access token is essentially a credential that tells Shopify:

"This request is coming from an app that has been authorized to access this store with these permissions."

Your app sends the token when making authenticated API requests.

Conceptually:

Authorization: Bearer ACCESS_TOKEN

Shopify then verifies the token and determines whether the request is allowed.

---

Why OAuth is important for Shopify Apps

Imagine Shopify apps didn't use OAuth.

Your app might have to ask the merchant:

"Give me your Shopify password."

That would be extremely dangerous. 🚨

With OAuth:

Merchant
   │
   │ logs into Shopify
   ▼
Shopify
   │
   │ grants selected permissions
   ▼
Your App

Your app doesn't need the merchant's Shopify password.

---

What are Scopes?

Scopes define what your app is allowed to do.

For example, an app might request permissions related to products.

Conceptually:

App permissions:

✓ Read products
✓ Write products
✗ Read customers
✗ Write orders

The principle is:

Request only the permissions your app actually needs.

This is called the principle of least privilege.

---

OAuth Flow — Simplified

For a Shopify app, you can remember the process like this:

1. Merchant installs app
          ↓
2. Shopify asks for permissions
          ↓
3. Merchant approves
          ↓
4. Shopify sends authorization code
          ↓
5. App exchanges code for access token
          ↓
6. App securely stores token
          ↓
7. App uses token to call Shopify API

The important pieces

Merchant
   ↓
Shopify
   ↓
Authorization
   ↓
Authorization Code
   ↓
Access Token
   ↓
Shopify Admin API

---

One important Shopify distinction

Modern Shopify apps can use different authentication approaches depending on the app architecture and whether you're dealing with embedded apps, app installations, Admin API access, customer-facing functionality, or Shopify's newer token/session mechanisms.

So don't think of Shopify authentication as simply:

"Use OAuth everywhere."

Instead, think:

Authentication identifies the requester/session, while authorization determines what the app is allowed to access. OAuth is a major part of granting an installed app access to a Shopify store's resources.

If you're building a Shopify app, understanding OAuth → access tokens → scopes → Admin API is one of the most important concepts to learn.