Connect

Call GET /v1/connect/shopify with profileId and shop on Get Shopify OAuth connect URL. Send the merchant to the returned authUrl.

After they approve the install, Shopify calls Zernio's callback. The account is created on your profile, and the browser lands on your redirect_url.

The connecting accounts guide covers the flow and scopes in general.

import Zernio from '@zernio/node';

const zernio = new Zernio();

const { data: connect } = await zernio.connect.getShopifyConnectUrl({
  query: {
    profileId: '66a1f0c2a4b9d3e8f1a2b3c4',
    shop: 'your-store.myshopify.com',
    redirect_url: 'https://myapp.com/connected'
  }
});
// Send the merchant's browser to connect.authUrl

Response (200):

{
  "authUrl": "https://your-store.myshopify.com/admin/oauth/authorize?client_id=...",
  "state": "..."
}

shop accepts the full domain or the bare your-store prefix.

redirect_url must be an absolute http(s) URL or an app scheme such as myapp://callback. A relative path is rejected with 400 INVALID_REDIRECT_URL.

Connecting the same profile to the same store again refreshes the stored token in place instead of creating a second account.

Custom-app Admin token

To skip the browser flow, the merchant creates a custom app in their Shopify admin (Settings, then Apps and sales channels, then Develop apps).

The app needs the read_content, write_content, read_products and write_products scopes. The merchant hands you its Admin API access token, which starts with shpat_.

Exchange it with Connect a Shopify store with a custom-app Admin token:

curl -X POST "https://zernio.com/api/v1/connect/shopify/token" \
  -H "Authorization: Bearer $ZERNIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "profileId": "66a1f0c2a4b9d3e8f1a2b3c4",
    "shop": "your-store.myshopify.com",
    "accessToken": "shpat_..."
  }'

Response (200):

{
  "account": {
    "_id": "66b2e19d8c3f5a7e9d0b1c2d",
    "platform": "shopify",
    "username": "your-store.myshopify.com",
    "displayName": "Your Store",
    "profileId": "66a1f0c2a4b9d3e8f1a2b3c4"
  }
}

shop is required here too: an Admin token does not identify its own store.

Zernio validates the token against the store before saving anything, and custom-app tokens do not expire.

OAuth scopes

Zernio requests no access to customers, orders or payments.

Commerce features such as stock, discounts or markets use optional scopes that the merchant approves separately (see Commerce).

Older stores. Stores connected before 16 September 2026 hold a content-only grant.

On those, every Products endpoint answers 403 insufficient_permissions until the merchant goes through the connect flow again. The consent screen shows the two product scopes, and the existing account keeps its id.

When the merchant uninstalls

Shopify invalidates its own token the moment the app is uninstalled and sends Zernio the app/uninstalled webhook. There is nothing to revoke and nothing to call.

Zernio deactivates that store's account. It stops appearing in GET /v1/accounts as active, and any request naming its accountId fails.

Scheduled articles on the account are held through the disconnect grace period rather than deleted at once. A reinstall inside that window brings them back with the account.

Reinstalling runs the same connect flow and issues a fresh token.