Shopify's consent page sends the browser here (design 14.0; 15.0 §3.2).

Checked in turn: the HMAC of the query, with the app's client secret; the shop's address; the state — signed, used once, naming the company and the shop — and that the person back is the one who asked (decision 222); that Shopify came back for the shop the state names. The code is then traded for an expiring offline token, kept sealed as the company's connection to the shop. The browser goes back to the portal's return_to with connector=shopify, shop and result=connected, or result=error and reason = denied, refused or failed.