Hi.
I want to set up my own Identity provider for the Shopify store, but I encountered a problem during the OAuth2 integration process.
In the ‘discover_endpoint’ section, I set ‘token_endpoint_auth_methods_supported’ to ‘private_key_jwt’, ‘client_secret_jwt’, and ‘client_secret_post’, but in the actual request, only the ‘client_secret_basic’ method is used.
The “client_secret_basic” method poses a risk of information leakage.
I would like to ask, does Shopify not support any other methods?
Thanks.
Hi @quanah_gong! When Shopify connects to your identity provider for customer accounts, it authenticates at the token endpoint using client_secret_basic. That’s the documented default, called out in the requirements for connecting your own identity provider
The identity provider supports the OAuth 2.0 authorization code flow. Implicit and hybrid flows aren’t supported. client_secret_basic is the default token endpoint authentication method.
Shopify won’t switch to private_key_jwt, client_secret_jwt, or client_secret_post based on what your token_endpoint_auth_methods_supported advertises, so your token endpoint needs to accept HTTP Basic auth for the integration to work.