We are building a public Shopify App Store app that integrates with Odoo ERP. Each merchant already has an authenticated Odoo database before installing the Shopify app. Our current flow asks the merchant for their Shopify store name in Odoo so our IAP(intermediate) service can construct the OAuth authorization URL (https://{shop}/admin/oauth/authorize) as documented in the Authorization Code Grant guide. The merchant then authenticates directly with Shopify and installs the app. Since App Store Requirement 2.3.1 states that apps should not request manual entry of the shop domain during installation, what is Shopify’s recommended installation pattern for ERP integrations that need to associate the installation with an existing external customer account? Is collecting the shop identifier from an authenticated Odoo session acceptable, or should installation always begin from a Shopify-owned surface?
If you’re publishing a public Shopify app then the Shopify OAuth requirement is first.
Then the merchant configures any additional integrations from the context of the AppBridge / their valid session on your app.
Thanks for the clarification.
I have one follow-up. The OAuth Authorization Code Grant documentation requires the shop parameter to construct the authorization URL:
However, the App Store Requirements state that apps must not request manual entry of a myshopify.com URL or shop domain during installation:
For a public Shopify App Store app, can we initiate the flow from an already authenticated Odoo session, ask for the shop name only to construct the OAuth URL, and then redirect the merchant to Shopify for authentication and app installation? Or must the installation always begin from a Shopify-owned surface, with the shop parameter provided by Shopify?
Odoo auth is outside of the scope of Shopify auth.
I recommend taking a look at Shopify’s managed auth for embedded apps. You’re in the weeds with a custom implementation which isn’t really necessary now.
Since you’re aiming for public app distribution, then you’re most likely embedding the app into the Shopify Admin.
You’ll need to most likely have an out of band authentication strategy to handle Oodo through a new window outside of Shopify with a secure nonce or token that represents the merchant’s Shopify installation.
But that’s really outside of the support here. That’s custom programming not really related to Shopify app dev.
Hey @pame_pah 
thanks for reaching out.
For a public App Store app, installation shouldn’t begin in Odoo or ask the merchant for their shop domain as you mentioned. Requirement 2.3.1 states that apps must be installed and initiated on Shopify services and must not request a shop domain during installation or configuration.
The shop value described in the Authorization Code Grant guide comes from Shopify’s signed installation request, which includes shop, timestamp, and hmac. It isn’t intended to be collected separately in Odoo.
A pattern supported by the documentation would be:
- Once your listing is available, direct the merchant from Odoo to the Shopify App Store listing. Both fully visible and limited-visibility apps are installed through an App Store URL, as described in the app listing visibility documentation.
- Let Shopify handle store selection, installation, and authentication.
- After installation, use the embedded app’s onboarding to connect the authenticated Shopify store to the merchant’s existing Odoo credentials. Shopify’s integration guidance describes linking the current store with an existing external account as the first in-admin onboarding step.
For an embedded app, Shopify recommends Shopify-managed installation with token exchange. Authorization Code Grant remains applicable to standalone or legacy apps, but it doesn’t change where a public-app installation must begin.
Hope this helps!