Skip to main content
ORCA
MES
EN

Shopify integration

Prepare Shopify GraphQL Admin API credentials for ORCA's one-time latest-order check.

The ORCA team can assist with the integration if needed.

Account and permissions

  1. You need a Shopify store and an owner/admin account allowed to develop and install apps.
  2. For Client Credentials, the app and target store must belong to the same Shopify organization.
  3. Order retrieval requires at least the read_orders access scope.

Create an API app in the Dev Dashboard

  1. In Dev Dashboard → Apps, select Create app → Start from Dev Dashboard and name the app.
  2. In Versions, set the app URL and newest Webhooks API version.
  3. Add at least read_orders to Access scopes and select Release.
  4. After releasing the version, open Home → Install app, select the target store, approve the permissions, and install the app. ORCA reports app_not_installed until this is complete.
  5. Locate the Client ID and Client Secret in Settings for entry in the ORCA sales-channel modal.
Shopify Dev Dashboard Apps screenShopify Dev Dashboard create app screen

Version configuration values

  1. App URL: all ORCA integration users should enter https://shopify.dev/apps/default-app-home. This is Shopify's default page for non-embedded API apps, not a store-specific URL.
  2. Use your own HTTPS app URL only if you have developed and deployed a separate Shopify app UI. This does not apply to the standard ORCA integration.
  3. Embed app in Shopify admin: clear the checkbox.
  4. Preferences URL: leave blank.
  5. Webhooks API version: select 2026-07.
  6. API access scopes: add read_orders.
  7. Optional scopes: leave blank.
  8. Use legacy install flow: leave disabled.
  9. Allowed redirection URLs: leave blank for client_credentials.
  10. POS: leave disabled.
  11. Application proxy: leave empty.
  12. Select Release after completing the configuration.

Issue and test the token through ORCA

  1. Open Settings in the Dev Dashboard and locate the Client ID and Client Secret.
  2. Open ORCA → Integration Management → Sales Channels → Add sales channel → Shopify.
  3. Enter a channel name, the canonical myshopify.com Store URL, Client ID, and Client Secret. The channel name is only an ORCA label and doesn't need to match the Store subdomain, but the Store URL must be exact.
  4. Run the connection test. Platform issues the Shopify token and verifies the official API connection.
  5. Save after the test succeeds. The Client Secret is encrypted at rest and the token is never displayed.

Official Shopify references

  1. Shopify APIs, libraries, and tools ↗
  2. Create apps using the Dev Dashboard ↗
  3. GraphQL Admin API 2026-07 ↗

Register in ORCA

  1. Open ORCA → Integration Management → Sales Channels.
  2. Choose Add sales channel → Shopify.
  3. Enter the channel name, myshopify.com URL, Client ID, and Client Secret.
  4. Save after Platform issues a token and the connection test succeeds.

ORCA Sales Channel Management →

Security and operation

  1. Never expose the Client Secret in a document, chat, shell history, or log.
  2. Grant only the minimum scopes required for order reads.
  3. Platform encrypts the Client Secret and automatically reissues expiring tokens. ORCA never displays the plaintext secret or token.
  4. For app_not_installed, install the app on the entered Store from Dev Dashboard → app Home → Install app, approve its permissions, and test again.
  5. For shop_not_permitted, confirm that the app and Store are in the same Shopify organization and that the app is installed on that Store.

Official Shopify authentication guide ↗