Shopify Install Auth

What it does

When your agent uses it

• Setting up a new Shopify app
• Configuring API credentials
• Initializing authentication for Admin
• Storefront API access

Example prompts

• “install shopify”
• “setup shopify”
• “shopify auth”
• “/shopify-install-auth”

Requirements

• Node.js
• A credential in SHOPIFY_API_KEY
• A credential in SHOPIFY_API_SECRET
• Compatibility (from SKILL.md): Designed for Claude Code
• Pre-approved tools (allowed-tools): Read, Write, Edit, Bash(npm:*), Bash(pnpm:*), Bash(npx:*), Grep

Workflow steps

7 steps, taken from the step headings in SKILL.md.

1. 1Install the Shopify API Library
2. 2Configure Environment Variables
3. 3Initialize the Shopify API Library
4. 4Implement OAuth Flow (Public Apps)
5. 5Token Exchange (Embedded Apps)
6. 6Custom App / Private App Auth
7. 7Verify Auth is Working

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Bash(npm:*)
  • Bash(pnpm:*)
  • Bash(npx:*)
  • Grep

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • npm

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • shopify.dev
  • partners.shopify.com
  • npmjs.com
  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • SHOPIFY_API_KEY
  • SHOPIFY_API_SECRET
  • SHOPIFY_ACCESS_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Designed for Claude Code

  From compatibility in the SKILL.md frontmatter.

Context cost

Shopify Install Auth loads about 1.6k tokens when it runs, and up to ~2.4k if it reads all its reference files. Until then it costs about 97 tokens; SKILL.md has 364 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~97

When it runs · the whole SKILL.md, loaded when a task matches

~1.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~2.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:54

  Create a `.env` file (add to `.gitignore` immediately):

• NoteMentions a .env fileSKILL.md:57

  # .env — NEVER commit this file

• NoteMentions a .env fileSKILL.md:74

  .env

• NoteMentions a .env fileSKILL.md:75

  .env.local

• NoteMentions a .env fileSKILL.md:76

  .env.*.local

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 364 words, ~1,636 tokens.

name

shopify-install-auth

description

Install and configure Shopify app authentication with OAuth, session tokens, and the @shopify/shopify-api SDK. Use when setting up a new Shopify app, configuring API credentials, or initializing authentication for Admin or Storefront API access. Trigger with phrases like "install shopify", "setup shopify", "shopify auth", "shopify OAuth", "configure shopify API".

allowed-tools

Read, Write, Edit, Bash(npm:*), Bash(pnpm:*), Bash(npx:*), Grep

compatibility

Designed for Claude Code

version

2.7.0

license

MIT

author

Jeremy Longshore <jeremy@intentsolutions.io>

tags

saas, ecommerce, shopify

# Core library + Node.js runtime adapter
npm install @shopify/shopify-api @shopify/shopify-app-remix
# Or for standalone Node apps:
npm install @shopify/shopify-api @shopify/shopify-app-express

# For Remix (recommended by Shopify):
npm install @shopify/shopify-app-remix @shopify/app-bridge-react

# .env — NEVER commit this file
SHOPIFY_API_KEY=your_app_api_key
SHOPIFY_API_SECRET=your_app_api_secret
SHOPIFY_SCOPES=read_products,write_products,read_orders,write_orders
SHOPIFY_APP_URL=https://your-app.example.com
SHOPIFY_HOST_NAME=your-app.example.com

# For custom/private apps only:
SHOPIFY_ACCESS_TOKEN=shpat_xxxxxxxxxxxxxxxxxxxxx

# API version — use a stable quarterly release
# Update quarterly — see shopify.dev/docs/api/usage/versioning
SHOPIFY_API_VERSION=2025-04

# .gitignore — add these immediately
.env
.env.local
.env.*.local

// src/shopify.ts
import "@shopify/shopify-api/adapters/node";
import { shopifyApi, LATEST_API_VERSION, Session } from "@shopify/shopify-api";

const shopify = shopifyApi({
  apiKey: process.env.SHOPIFY_API_KEY!,
  apiSecretKey: process.env.SHOPIFY_API_SECRET!,
  scopes: process.env.SHOPIFY_SCOPES!.split(","),
  hostName: process.env.SHOPIFY_HOST_NAME!,
  apiVersion: LATEST_API_VERSION,
  isEmbeddedApp: true,
});

export default shopify;

// Token exchange — converts session token (JWT) to API access token
import shopify from "../shopify";

async function exchangeToken(
  shop: string,
  sessionToken: string
): Promise<Session> {
  const { session } = await shopify.auth.tokenExchange({
    sessionToken,
    shop,
    requestedTokenType: RequestedTokenType.OfflineAccessToken,
  });
  return session;
}

// Quick connectivity test
async function verifyShopifyAuth(session: Session): Promise<void> {
  const client = new shopify.clients.Graphql({ session });

  const response = await client.request(`{
    shop {
      name
      email
      plan {
        displayName
      }
      primaryDomain {
        url
      }
    }
  }`);

  console.log("Connected to:", response.data.shop.name);
  console.log("Plan:", response.data.shop.plan.displayName);
  console.log("Domain:", response.data.shop.primaryDomain.url);
}

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (references) in skills/.curated/shopify-install-auth of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• references/custom-app-auth.md
• references/oauth-flow.md
• references/storefront-api-access.md

Open the folder on GitHubat commit cfae287