Issues integrating Shopify OAuth in our app — receiving 403 Forbidden during authorization

Authentication & Access
1

Hello,

I have been working to integrate OAuth authentication for our Shopify app using the official Shopify API library (@shopify/shopify-api) in a Next.js app.I followed the documented OAuth flow, including:

  • Initiating OAuth at /api/shopify/auth with the shop parameter.

  • Receiving redirect responses from Shopify to the authorization URL.

  • Handling the OAuth callback at /api/shopify/callback and calling shopify.auth.callback().

Despite correct setup and environment variables, including:

  • Correct API key and secret,

  • Matching app URL and allowed redirect URLs in the Shopify Partner Dashboard (using a public ngrok domain),

  • Admin user logged into the dev store during flow,

  • Using the latest SDK version (12.0.0) and proper adapters,

I encounter a persistent 403 Forbidden error when the browser is redirected to the Shopify OAuth authorization URL (https://{shop}/admin/oauth/authorize?...). This error gives no detailed explanation, making debugging difficult.

I’ve verified:

  • The shop parameter is the correct store domain,

  • The redirect URI encoding is correct (no double protocols),

  • OAuth scopes are set properly,

  • Cookies and session states are maintained,

  • I do not manually call the callback URL,

  • The environment does not have conflicting configurations.

I would appreciate any guidance on:

  • What additional checks can I perform to identify the root cause of this 403 error?

  • Are there any specific app configurations or Shopify restrictions that might cause this error despite correct OAuth implementation?

  • How can I obtain more detailed error messages or logs for our failed OAuth attempts?

Request ID from Shopify for the last failure is: 36a5144c-1e91-4288-86ed-62249dc2260c-1759139603

Thank you for your assistance. I look forward to resolving this issue to complete our app’s OAuth integration.

1 Like
2

Hey @Aman_Kumar1 :waving_hand: - thanks for sharing that request ID, it’s really appreciated. On our end, the error that I’m seeing mentions that the access token is valid, but the account that requested the app installation is not a valid one to be making the installation request. This can usually be resolved if the user who is requesting the app installation has app configuration permissions on the shop. If that is already the case though and you/the user should have app installation access on the shop, just ping me here (and please share a new example request ID if possible) and I’d be happy to keep looking into this with you. Just let me know :slight_smile: