Shopify guide

Connect a Shopify store and check its permissions

Connect your store, verify current access, and see what a permission or setup warning means.

The Shopify management page checks the connected store and its granted scopes live. A saved connection or an earlier successful check is not proof of current access until Shopify verifies it again.

  1. 01

    Enter the store domain

    Sign in to RummageRail and open Shopify management. Enter a store host such as your-store.myshopify.com, without a path, port, query, or fragment. The connection accepts a myshopify.com store domain; it does not connect from a Shopify Admin page URL.

  2. 02

    Start Shopify authorization

    Choose Connect Shopify or Reauthorize store. Shopify opens its authorization screen for the store. The request includes read_products, write_products, read_orders, read_inventory, and write_inventory; only the scopes Shopify actually grants count as verified.

  3. 03

    Read current status and capability availability

    The panel shows the store domain, live connection state, scopes Shopify confirmed, and whether each capability is currently available. When a successful check exists, the panel shows its timestamp. Use the per-capability reason to see which permission or setup step is missing.

  4. 04

    Reauthorize when a scope is missing or access changed

    If the panel reports missing scopes, the Shopify app owner must first enable the needed permissions in the app configuration. Reauthorize the store afterward so Shopify can grant and RummageRail can verify those scopes. Reauthorize after access is revoked or new consent is required; reconnect when offline access has expired.

  5. 05

    Treat unavailable and incomplete checks as unverified

    If Shopify cannot be reached, authorization details are incomplete, or the status request fails, retry the live status check before using a capability. The page may retain a previous successful timestamp and scopes for reference, but labels them historical until a current check succeeds.

  6. 06

    Ask the app owner to finish app setup

    Only the RummageRail app owner can supply the real SHOPIFY_API_KEY and SHOPIFY_API_SECRET, a 64-character hexadecimal SHOPIFY_TOKEN_ENCRYPTION_KEY, and the exact secure callback registration. Register the same full SHOPIFY_CALLBACK_URL in the Shopify app: it must use the configured trusted HTTPS app origin and the /api/shopify/callback path. If the setup note displays only the app origin or omits that path, setup is incomplete; ask the app owner to correct the callback before connecting. Sellers cannot repair missing app configuration from their store screen; use the existing RummageRail support path.

Before you finish

  • Check the current store, scopes, capability states, and last successful verification before acting.
  • After changing Shopify app permissions, reauthorize the store and wait for a successful live check.
  • Treat a failed or incomplete check and any previous result as unverified or historical.
  • Send app-credential, encryption-key, or callback setup issues through the existing RummageRail support path.

Related guides

Back to Help directory