# Shopify setup for PopMCP

You end up with three things to paste into PopMCP: your *.myshopify.com store domain, plus the Client ID and Client secret of an app you create in the Shopify Dev Dashboard. You then tick the permissions and let PopMCP run the OAuth install.

- Auth: OAuth authorization
- Setup time: 10 min
- API base URL: https://{shop}.myshopify.com/admin/api
- Credentials screen: https://dev.shopify.com/dashboard
- Provider docs: https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/authorization-code-grant

## Before you begin

- A Shopify store you can install apps on, plus the store's *.myshopify.com domain
- A Shopify account with access to a Dev Dashboard organization at dev.shopify.com
- Store owner, or a staff account with the 'Manage and install apps' permission, to approve the install
- PopMCP's callback URL, copied from the Shopify connect form. It has to be pasted into the app before you connect

## Get your credentials

### 1. Create an app in the Dev Dashboard

Open Apps in the left navigation and click Create app in the top right. Choose Start from Dev Dashboard, name the app `PopMCP`, and click Create.

Screen: https://dev.shopify.com/dashboard

### 2. Add PopMCP's redirect URL and the access scopes, then release

Open the app's Versions tab. Paste PopMCP's callback URL into Redirect URLs, set the App URL to the same host, tick the scopes the tools need, and click Release.

Screen: https://dev.shopify.com/dashboard

### 3. Copy the Client ID and Client secret

Open the app's Settings tab and find the Credentials section. Copy the Client ID and the Client secret.

Screen: https://dev.shopify.com/dashboard

### 4. Find your store domain

In the Shopify admin, open Settings, then Domains, and copy the `*.myshopify.com` row. The same handle appears in the admin URL as `admin.shopify.com/store/<handle>`.

Screen: https://admin.shopify.com/

### 5. Connect from PopMCP and approve the install

Paste the store domain, Client ID and Client secret into PopMCP, leave the default permissions ticked, and click connect. On Shopify's install screen, review the scopes and click Install.

## Fields PopMCP asks for

- Store domain (shop) [required]: Your *.myshopify.com domain (or just the store handle).
- Client ID (clientId) [required]: From your app's Client credentials in the Shopify Dev Dashboard.
- Client secret (clientSecret) [required]: Stored encrypted and used only server-side — it never reaches the browser.
- Permissions to request (scopes) [required]: Shopify grants exactly what you tick here. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.

## Callback URL to register

https://app.popmcp.com/api/providers/shopify/callback

## Verify

After the Shopify install screen, PopMCP shows the connector as Connected with your store handle. Asking for recent orders or a product count returns real data from that store.

## Troubleshooting

### "The redirect_uri is not whitelisted" during install

Cause: PopMCP's callback URL is not in the app's Redirect URLs, or the released version does not include it.

Fix: Paste the callback URL exactly as PopMCP shows it into Versions, Redirect URLs, then click Release. Unreleased edits are not live.

### "redirect_uri and application URL must have matching hosts"

Cause: The App URL and the redirect URL point at different hosts.

Fix: Set the App URL to the same origin as PopMCP's callback URL, then release again.

### 401 or "Invalid API key or access token" on every call

Cause: The client secret was rotated in the Dev Dashboard, or a legacy custom-app admin token was pasted into the Client secret box.

Fix: Copy the current Client ID and Client secret from the app's Settings, Credentials section and reconnect.

### Some tools return 403 with an access-scope error

Cause: That scope was not ticked when you authorised. Shopify grants only what was requested, so unticked permissions leave those tools listed but failing.

Fix: Tick the missing scope on the app version, click Release, then reconnect in PopMCP so the merchant re-approves the wider list.

### Orders older than 60 days come back empty

Cause: Standard read_orders only covers the last 60 days.

Fix: Request the read_all_orders scope from Shopify for the app, then reconnect.

### Merchants lose access after you rotate the secret

Cause: The old secret was revoked before stored tokens were updated.

Fix: Keep both secrets valid until PopMCP has reconnected, then revoke the old one.

---

Source: https://www.docs.popmcp.com/docs/integrations/shopify/