We’re submitting our app’s MCP server to the Claude Connectors Directory and the OpenAI (ChatGPT) app directory. Both review teams need to connect the app themselves, and our authorization flow requires a real Shopify admin session: the reviewer picks the store, signs in to Shopify admin, and approves access inside our embedded app. We don’t want to bypass that; it’s how we tie an agent connection to an authenticated merchant.
For review we created a dedicated staff account on a development store (test data only), with narrow permissions. The problem is sign-in:
- Every login asks for a verification code emailed to the account.
- We turned off Secure sign-in method for that staff member, but the email code still appears on every login.
- Reviewers sign in from their own browsers on their own schedule, so an emailed code we’d have to relay by hand would stall review. OpenAI’s reviewer guidance asks for access without interactive MFA, SMS or email confirmation.
Questions:
- What triggers the emailed code for a staff account that doesn’t require two-step authentication? Is it new-device verification, and can it be turned off for a development store’s staff account?
- Is there a recommended way to give third-party app reviewers access to a development store’s admin, for example collaborator access or another account type meant for this?
Thanks!