Sign-in for Shopify apps

For Shopify app developers who need to sign in a person separately from the merchant install: call CorroborateMe from your app's backend. $5.99 a month or $55 a year. There's no Shopify-specific app or SDK.

What this does not replace

Installing a Shopify app and identifying the merchant in Shopify's admin are Shopify's own OAuth and session. This product does not implement those. Use CorroborateMe when your app needs a separate sign-in for a person, and your backend can send HTTPS.

Setup

• Create a company and an aa_ API key in the console, or with POST /api/agents/bootstrap as described in the docs. The company must be on Pro.
• From the app backend (not from a theme liquid file), POST /api/login-links.
• Give the person loginUrl. They sign in on the hosted page.
• Poll GET /api/login-links/{sessionId} until status is completed and user_id is set. Store that id on your side, next to whatever Shopify id you already have.

const created = await fetch("https://corroborateme.com/api/login-links", {
  method: "POST",
  headers: {
    Authorization: "Bearer aa_YOUR_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ state: "job-42" }),
}).then((r) => r.json());

// created.sessionId, created.loginUrl
// Show loginUrl to the person, then:

const status = await fetch(
  "https://corroborateme.com/api/login-links/" + created.sessionId,
  { headers: { Authorization: "Bearer aa_YOUR_KEY" } },
).then((r) => r.json());
// status.status, status.user_id, status.email

Redirect delivery is optional. It needs POST /api/webhooks/allowlist with a url_prefix you control before you pass redirect_uri. Poll works without that step, so the sample above uses poll.

If you want a browser redirect into an OIDC client instead of a login link, register one with POST /api/oidc/clients and read the authorization endpoint from GET /api/auth/.well-known/openid-configuration. Use a redirect URI on a host you control.