How to get Shopify to redirect to a subdomain of the application URL?

Question

I am starting to develop a Shopify integration. The app that I am trying to integrate has a different subdomain per user account, and so will need to redirect to a different callback domain for each oauth connection request. So far I am redirecting to the Shopify authorise URL to allow the user to grant access to their account. However, I get an error response of:

{"error":"invalid_request",
 "error_description":"The redirect_uri and application url must have matching hosts"}

The URL is of the form:

https://SHOP_NAME.myshopify.com/admin/oauth/authorize?client_id=MY_CLIENT_ID&scope=read_order&redirect_uri=SUBDOMAIN.MYAPP.com

I have tried setting the application URL (set in the admin page in Shopify) to all of these and receive the same error:

http://MYAPP.com
http://.MYAPP.com
http://*.MYAPP.com

However, I can get it to work with:

http://SUBDOMAIN.MYAPP.com

I can create an endpoint that just takes information from the query string, and redirects to the subdomain, for example:

callback.MYAPP.com?subdomain=SUBDOMAIN

Which would work around this, but I would rather that the Shopify API supported subdomains since I would like to also create links in the Shopify pages into my app, and would rather not have to keep building these levels of indirection. (Although, looking at the admin page for the application links, it looks like I will have to do the same there too.)

I am using a non-standard TLD (since this is currently in development). So where I've put MYAPP.com it's really oh.dev, however I have tried using a .com by editing my hosts file, with the same results.

Does anyone know how to get Shopify to accept a subdomain as a callback_url? Have I missed something obvious?

Here's some Clojure code:

(require '[com.twinql.clojure.http :as http] '[clojure.contrib.logging :as log])

(defn consumer []
  {:key "1234567890"
   :secret "1234567890abcde"})

(defn shopify-config [shop-name]
  {:request-token-url (str "https://" shop-name ".myshopify.com/admin/oauth/authorize")
   :authorise-url (str "https://" shop-name ".myshopify.com/admin/oauth/authorize")
   :access-token-url (str "https://" shop-name ".myshopify.com/admin/oauth/access_token")
   :api-endpoint-url (str "https://" shop-name ".myshopify.com")})

(defn get-redirect-url [shop-name callback-url]
  (let [{consumer-token :key consumer-token-secret :secret} (consumer)]
    (str (-> shop-name shopify-config :request-token-url)
         "?client_id=" consumer-token
         "&scope=read_orders,read_products,read_customers"
         "&redirect_uri=" callback-url)))

(defn get-access-credentials [verifier shop-name]
  (let [{:keys [key secret]} (consumer)
        response (http/post (-> shop-name shopify-config :access-token-url)
                            :as :json
                            :query {"client_id" key
                                    "client_secret" secret
                                    "code" verifier})]
    (log/debug (str "response from getting access credentials from shopify : " response))
    {:access-token (-> response :content :access_token)
     :consumer-key key
     :consumer-secret secret}))

(def methods {:get http/get
              :post http/post
              :delete http/delete
              :put http/put})

(defn- make-request [method shop-name url token params]
  (let [response (method (str (-> shop-name shopify-config :api-endpoint-url) url)
                         :as :json
                         :query params
                         :headers {"X-Shopify-Access-Token" token})]
    (if (-> response :code (= 200))
      (:content response)
      (do
        (log/error (str "Error in shopify request : " response))
        (throw (Err. {:handle :shopify-request-error
                      :response response}))))))

(defn get-products [shop-name token page]
  (make-request (:get methods) shop-name "/admin/products.json" token {:page page :limit 200}))

Also, there is some code that gets things like the shop-name from the user, and stores it in the DB and so on. So we basically call get-redirect-url to redirect the user to shopify, and get them to approve the permissions. The callback-url that we pass to Shopify is something like:

http://customer1.oh.dev/integrations/shopify/1/callback

Which then takes the code provided and calls get-access-credentials. The surrounding code stores the access-token, etc that we return. Then there is an other user action that will call get-products, after retrieving the token & shop-name.

John Duff John Duff · Accepted Answer · 2012-09-19T11:38:23

If you set the application URL to http://myapp.com you should be able to specify the redirect_uri=http://domain.myapp.com, is this what you are doing? Can you post the code you are using to make the oauth request?

How to get Shopify to redirect to a subdomain of the application URL?

1 Answers