Skip to content

fix(shopify): drop "shopify" token from OAuth URLs #541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guitavano merged 2 commits into from
Aug 18, 2026
Merged

fix(shopify): drop "shopify" token from OAuth URLs #541

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c22038
fix(shopify): drop "shopify" token from OAuth URLs
guitavano Aug 18, 2026
8fff1eb
chore: rebuild registry.json for shopify host change
guitavano Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion registry.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3059,7 +3059,7 @@
"remotes": [
{
"type": "HTTP",
"url": "https://sites-shopify.deco.site/mcp",
"url": "https://mcp-commerce-store.deco.site/mcp",
"name": "shopify",
"title": "Shopify",
"description": "MCP for the Shopify Admin GraphQL API — read products, collections, orders, draft orders, customers, inventory, fulfillment, discounts, online store content, B2B, markets, Shopify Payments and ShopifyQL analytics, plus edit theme files (Liquid & assets)."
Expand Down
2 changes: 1 addition & 1 deletion shopify/app.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"friendlyName": "Shopify",
"connection": {
"type": "HTTP",
"url": "https://sites-shopify.deco.site/mcp"
"url": "https://mcp-commerce-store.deco.site/mcp"
},
"description": "MCP for the Shopify Admin GraphQL API — read products, collections, orders, draft orders, customers, inventory, fulfillment, discounts, online store content, B2B, markets, Shopify Payments and ShopifyQL analytics, plus edit theme files (Liquid & assets).",
"icon": "https://github.com/shopify.png",
Expand Down
6 changes: 3 additions & 3 deletions shopify/server/lib/oauth.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import {
} from "./token.ts";
import { createHmac } from "node:crypto";

const SELF = "https://sites-shopify.deco.site";
const SELF = "https://mcp-commerce-store.deco.site";
const MESH = "https://api.decocms.com";
const SECRET = "oauth-test-secret";
const CLIENT_ID = "test-client-id";
Expand Down Expand Up @@ -58,7 +58,7 @@ describe("authorizationUrl", () => {
test("defaults to the prod domain (not localhost) when SELF_URL is unset", () => {
delete process.env.SELF_URL;
const url = new URL(shopifyOAuth.authorizationUrl(CALLBACK));
expect(url.origin).toBe("https://sites-shopify.deco.site");
expect(url.origin).toBe("https://mcp-commerce-store.deco.site");
});
});

Expand Down Expand Up @@ -167,7 +167,7 @@ describe("GET /oauth/custom", () => {
});
});

describe("GET /oauth/shopify/callback", () => {
describe("GET /oauth/store/callback", () => {
function callbackUrl(overrides: Record<string, string> = {}): string {
const state = signState({ cb: CALLBACK }, SECRET);
const base: Record<string, string> = {
Expand Down
10 changes: 6 additions & 4 deletions shopify/server/lib/oauth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
* 2. `/oauth/custom` renders a form; on submit it 302s to Shopify's
* `/admin/oauth/authorize` with `redirect_uri` pointing back at us and the
* mesh callback URL signed into `state`.
* 3. Shopify → `/oauth/shopify/callback?code&shop&state&hmac`. We verify the
* 3. Shopify → `/oauth/store/callback?code&shop&state&hmac`. We verify the
* HMAC + state, exchange the code for an *expiring* offline token, seal the
* `{shop, access, refresh, expiresIn}` grant into an encrypted blob, and
* 302 back to the mesh callback with it as `code`.
Expand Down Expand Up @@ -41,7 +41,9 @@ import {
} from "./token.ts";

export const OAUTH_CONNECT_PATH = "/oauth/custom";
export const OAUTH_CALLBACK_PATH = "/oauth/shopify/callback";
// Kept free of the "shopify" token (Shopify forbids it in app URLs) and distinct
// from `/oauth/callback`, which the runtime mounts on this same origin.
export const OAUTH_CALLBACK_PATH = "/oauth/store/callback";

/**
* Scopes requested during the grant. Almost all are read scopes; `write_themes`
Expand Down Expand Up @@ -82,7 +84,7 @@ export function getScopes(): string {

/** This MCP's own public origin. Deployed at a fixed domain, so we default to
* it; override with SELF_URL for local dev (e.g. http://localhost:8001). */
const DEFAULT_SELF_URL = "https://sites-shopify.deco.site";
const DEFAULT_SELF_URL = "https://mcp-commerce-store.deco.site";

interface OAuthEnv {
clientId: string;
Expand Down Expand Up @@ -374,7 +376,7 @@ function handleConnect(url: URL, env: OAuthEnv): Response {
return Response.redirect(authorize.toString(), 302);
}

/** GET /oauth/shopify/callback — validate Shopify's redirect, exchange the code
/** GET /oauth/store/callback — validate Shopify's redirect, exchange the code
* for an expiring offline token, seal the grant, and bounce back to the mesh
* callback. */
async function handleCallback(url: URL, env: OAuthEnv): Promise<Response> {
Expand Down
Loading