---
title: "Shopify Callback"
method: GET
path: "/connectors/shopify/callback"
tags: ["connectors"]
---

# Shopify Callback

`GET /connectors/shopify/callback`

## Request

- Base URL: `https://app.zalster.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zalster.com/connectors/shopify/callback`
- Auth: none declared

Shopify's consent page sends the browser here (design 14.0; 15.0 §3.2).

Checked in turn: the HMAC of the query, with the app's client secret; the
shop's address; the state — signed, used once, naming the company and the
shop — and that the person back is the one who asked (decision 222); that
Shopify came back for the shop the state names. The code is then traded
for an expiring offline token, kept sealed as the company's connection to
the shop. The browser goes back to the portal's ``return_to`` with
``connector=shopify``, ``shop`` and ``result=connected``, or
``result=error`` and ``reason`` = ``denied``, ``refused`` or ``failed``.

## Query parameters

- `code` string, nullable: The code to trade for a token
- `shop` string, nullable: The shop, <name>.myshopify.com
- `state` string, nullable: The state the consent page was given
- `error` string, nullable: Set when the consent page was declined

## Other responses

- `307`: Successful Response
- `422`: Validation Error

---

[API](https://skmtc.dev/zalster/apis/zalster-feed-processor.md) - [All operations](https://skmtc.dev/zalster/apis/zalster-feed-processor/llms.txt) - [OpenAPI document](https://skmtc.dev/zalster/apis/zalster-feed-processor/revisions/d0b9dc66ad36?raw)