Connect Shopify: custom app or public app

Purpose#

There are two ways to connect Shopify. The manual method from the Store integrations page is implemented and works with an app you create yourself (a Dev Dashboard app or a legacy Custom App). The public app (installing from Shopify, or the "One-click connect" button) is partial: it works only once the platform administrator has configured the Shopify app credentials on the server. Either way orders become parcels and the status goes back to Shopify.

Who can use it and what you need#

• A platform merchant whose plan includes Store integrations and who has room under "Number of connected stores", plus an available delivery company and an active pickup location, both mandatory. A merchant created by a delivery company cannot open the page.
• The store owner's Shopify account, because the Dev Dashboard app must be created in the same organization as the store.
• The permissions the page lists: read_orders, write_orders, read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders and write_shipping.

Manual connection steps#

1. Create the app in the Dev Dashboard

   From dev.shopify.com, with the store owner's account: Apps → Create app, name Delivery Syria.

2. Choose the permissions and release the version

   In Versions choose the permissions listed above, then Release.

3. Install the app on your store

   Press Install app on your store and approve the permissions.

4. Paste the Client ID and Client secret

   From Settings copy the Client ID and Client secret. In Store integrations, on the "Dev Dashboard app (new)" tab, paste them with the store name as mystore.myshopify.com, choose the shipping company and pickup location, then press Connect Shopify.

5. Check the result

   The platform tests the connection and reading orders, saves it and registers the orders/create and orders/updated webhooks. On success you see "Webhooks registered in Shopify (new order + order update).". If registration fails the connection stays, with a warning, and you retry with Re-register Webhooks once the cause is fixed.

123

1. See this store's orders
2. Delivery company for the store's orders
3. Default pickup place

Other ways to connect#

• Legacy Custom App (shpat): if you have an app created from the store admin before 2026 use the "Legacy Custom App (shpat)" tab and paste the Admin API access token (starts with shpat_) and the API secret key, with the same permissions.
• "One-click connect": its form appears at the top of the Shopify card only if the public app is configured on the server. Enter the store name and choose the company and pickup location; you go to Shopify to approve, then return and the connection completes while you are signed in, and the store shows the "— app" label.
• Installing from Shopify: after approval you land on a page where you sign in with your merchant account (email or mobile), choose the company and pickup location and confirm; the link is valid for 30 minutes. Webhooks are registered at /api/stores/shopify/app together with app/uninstalled, and removing the app from the store suspends the connection.

Expected result#

Weight comes from the item weights, otherwise the default weight. When the parcel is created a Fulfillment is created with the tracking number, the company name Delivery Syria and a tracking link, and the customer receives a Shopify notification. If there is no open Fulfillment Order the message "There is no open Fulfillment Order for this order in Shopify…" appears. Events are then sent: courier assigned or delivery rescheduled out_for_delivery, delivered or partially delivered delivered, delivery failed failure, arrival at the warehouse confirmed.

Signature verification: Shopify sends the X-Shopify-Hmac-Sha256 header (Base64 of HMAC-SHA256 of the body) using the app secret, that is the Client secret or the API secret key. A bad request is rejected with HTTP 401 (Invalid signature).

Shipping rate at checkout#

With the public app the platform registers a "Delivery Syria" shipping method and Shopify asks for its rate at /api/stores/shopify/rates during checkout. The method (DS_STANDARD) is offered with a price calculated as at parcel creation only if the destination is Syria, the governorate is recognized, the connection is active with a delivery company, the price is above zero and the store currency has an exchange rate. If your Shopify plan does not support calculated rates the method is not registered and orders still arrive normally.

Privacy requests#

/api/stores/shopify/compliance accepts requests with a verified signature: customers/redact clears the stored data and customer name of the listed orders, and shop/redact suspends the connection, deletes the credentials and clears the stored order data. Parcels remain as shipping records, and customers/data_request is only logged.

Common mistakes#

Limits and permissions#

• Connecting with the manual form (Dev Dashboard or Legacy tab) is limited to 20 requests per minute; on the public-app page, sign-in is limited to 5 per minute and confirmation to 10; receiving webhooks is limited to 240 per minute. Order, app (uninstall) and privacy webhooks are signature-verified; the checkout rates callback rejects an invalid signature but does not require the header.
• Credentials and the secret are stored encrypted, and with a Dev Dashboard app the token (24 hours) renews automatically.
• The tracking link sent to Shopify opens the website's tracking page for the parcel, not the public per-parcel page that Salla receives.
• The public-app pages and many messages are in Arabic only, including the two marked above; the English here is a translation.