Is one-time secure linking step acceptable for embedded app

Partner Discussions
1

Hi,

Will a one-time verification of the store owner’s identity, handled via a short-lived off-platform link sent via email after app installation, be acceptable to pass review of an embedded app?

Our review submission was returned with feedback that we cannot have an embedded app experience that included activity in an off-platform system, but our thinking is that it was because at that time, we required the user to launch our portal in another tab (using a button from the embedded UI). We are thinking to change this to leverage the email but want to better understand this requirement.

For reference, our app is an unlisted app for our current customers, but we still need a way to one-time verify the identity of the store owner to an appropriate account on our side.

Thanks,
Corey

1 Like
2

Hey @Corey!

Can you share the exact criteria that your app review failed on?

Our best practices for integrating are listed here: Integrating with the Shopify admin

Based on what you have shared, the issue looks to be around the button in your UI; instead the one time verification should immediately follow the authentication steps. From the doc I linked above:

The first step to the in-admin onboarding of these apps must always be a workflow that enables a merchant to link the current store with their existing credentials.

3

Thanks for the reply @KyleG-Shopify!

Here was the direct feedback:

“Your app must provide a consistent embedded experience by ensuring that any off-platform features are integrated directly within the Shopify Admin. See screencast for additional details. Ensure a consistent user experience which means if the app is intended to be embedded, then all the features and functionalities available for Shopify merchants should only be accessed through an embedded UI. This is the same expectation when the app is intended to be a non-embedded app where all features and functionalities should only be accessed through the non-embedded UI.”

From the best practices link, the “Exception” applies to our situation, i.e.:

“Access to some apps cannot be easily obtained by merchants in a self-service manner, and require a more complex sign-up, often involving a business-to-business contract. Examples of this include connecting to ad networks or allowing non-merchants to log in. These apps aren’t required to enable seamless sign up using a merchant’s credentials. The first step to the in-admin onboarding of these apps must always be a workflow that enables a merchant to link the current store with their existing credentials.”

I have since seen an email reply from the support team for my inquiry as well:

“Concerning your query, implementing a one-time secure linking step for identity verification is acceptable, and returning the user to Shopify after the verification process is a solid approach. However, since all features are accessed through your non-embedded UI, we recommend redirecting users to the portal immediately after installation, as the embedded UI would not be useful in this case. Refer to [screencast], which should redirect us to the app UI or portal immediately after OAuth.”

It seems then sufficient to, immediately after auth completes on Shopify, redirect them to our off-platform portal for identity verification, and simply not require a button click. It also sounds like the button remaining is not a problem as long as it remains optional to use to access our off-platform portal in general.

The screencast was welcome and very helpful, just I initially drew the wrong conclusion from it. I think I get it now, though! If this all sounds right, I think we are all set.

5

Hey! That all sounds right to me! It’s great that they were able to provide that direct clarification with a screencast!

1 Like