app-authlisted

# Shopify App Authentication Shopify provides multiple authentication flows depending on your app type and use case. The modern standard is **Token Exchange** (2024+) for server-rendered apps, **Managed Installation** for headless apps, and **OAuth 2.0 Authorization Code Grant** for legacy/custom implementations. All flows result in an access token for the Shopify GraphQL Admin API. ## Authentication Flows Overview ### 1. Token Exchange (Recommended for 2024+) **Use Case:** Server-rendered apps (Remix, Next.js with SSR), Shopify CLI apps **Flow:** Merchant installs app → Shopify generates temporary exchange token → App exchanges for access token **Security:** No client secret exposed; uses PKCE-style rotation per request **Token Lifetime:** Access tokens are short-lived; refresh tokens rotate automatically **Token Exchange Diagram:** ``` 1. Merchant clicks "Install" in Shopify Admin 2. Shopify redirects: https://your-app.com/auth/callback?code=EXCHANGE_TOKEN 3. App validates HMAC, exchanges code for access token (private, server-side only) 4. Shopify Admin API grants scopes; token stored in session/database 5. Token auto-refreshes on next request if expired ``` **Remix Implementation (Token Exchange):** ```typescript // shopify.app.ts (App Configuration) import { shopifyApp } from '@shopify/shopify-app-remix/server'; import { restResources } from '@shopify/shopify-api/rest/admin/2026-07'; import { PrismaSessionStorage } from '@shopify/shopify-app-session-storage-prisma