Access Token Not Generated When Using Shopify Managed Installation Flow With Version (v19.1)

[thesunilyadav]

Description

I am encountering an issue with the laravel-shopify package (version ^19.1) after switching from the legacy installation flow to Shopify's managed installation flow.

With use_legacy_install_flow = true in the shopify.app.toml file, the application functioned correctly. However, due to requirements such as registering webhooks via a configuration file, I updated the configuration to use_legacy_install_flow = false to adopt the managed installation flow.

After deploying this change and installing the app on a new Shopify store, the installation completes successfully, but the app fails to function, displaying a blank screen.

Upon inspecting the database (users table), I found no access token stored for the shop. This suggests a potential issue with authentication during the managed installation process, possibly linked to package compatibility or Shopify's updated installation requirements.

Steps to Reproduce

• Set up a new Shopify app using the laravel-shopify package (version ^19.1).
• In shopify.app.toml, configure use_legacy_install_flow = false
• Deploy the application (shopify app deploy)
• Install the app on a new Shopify store.
• Observe that the app installs but displays a blank screen when accessed.
• Check the database (users table) for the shop's access token, confirm it is not present.

Expected Behavior

• The app installs successfully.
• An access token is generated and stored in the database for the shop.

Actual Behavior

The app installs but displays a blank screen.
No access token is stored in the database.

Environment

• Laravel version: ^10.10
• PHP version: 8.1
• Shopify API version: 2025-01
• Package version: 19.1
• Database: MySQL

Additional Information

• The app works as expected with use_legacy_install_flow = true, including proper access token storage.
• The issue is specific to use_legacy_install_flow = false.
• No obvious errors were found in the Laravel logs during installation.

Hi @Kyon147, I’ve reviewed both the package wiki and the issues but couldn’t find any specific information about Shopify’s managed installation. Could you please provide some guidance or insight to help me move forward?

Your assistance would be greatly appreciated.

Reference:

• https://shopify.dev/docs/apps/build/authentication-authorization/app-installation
• https://community.shopify.dev/t/session-access-token-exchange-with-managed-install-query-params/2372

[mauveine]

I found this problem recently too. It's a big one for using appbridge and installation

[Kyon147]

This is quite new to me to be honest, the app has not had an update to allow for the new managed install flow.

We will need to introduce a PR to add in whatever is needed to get it working.

I'll take a look this weekend but if someone wants to open a PR please do.

[thejamescollins]

I'm quite new to the Shopify app ecosystem.

Our app was approved 2 weeks ago and uses this package.

I've recently seen user table records created without any password data in the database.

It seems to work for some merchant installs but not for others.

Does this mean we need to follow https://shopify.dev/docs/apps/build/authentication-authorization/app-installation and implement the token exchange process in this package?

[thejamescollins]

I'm also wondering if this shopify issue that was fixed 24 hours ago may be a factor here too:

https://community.shopify.dev/t/issue-with-managed-installs-4-14-25/13491/4

[thesunilyadav]

@thejamescollins I don’t think that’s the case, I actually encountered this issue two weeks ago, while the Shopify issue only came up 1 day ago. So I don’t believe the root cause is on Shopify’s side for the issue mentioned here.

From what I’ve observed, the package doesn’t currently support the managed installation flow. I’d be happy to contribute to the codebase if someone can guide me on which areas I should look into.

[thejamescollins]

Our new app defines to scopes in the toml file, so I think that means I'm using the managed app installation process for our app?

It's been working fine and as expected, only in the last week has it not had a password (api key) saved in the users table for new installs.

However I tried it myself a few days back and it worked fine.

So I'm a little confused as to why it's intermittent.

I'm also happy to contribute a PR if it's needed but so far I haven't been able to reliably replicate it.

[Kyon147]

I've noticed while working on some app updates, that Shopify are pushing more and more into using their CLI for everything.

I think I'll need to also look at adding in getting the package set up more cleanly with the CLI and how things like extensions etc can function with it.

Most of my apps are 50/50 at the moment, some stuff is cli and some is in the partners dash but just not had the time to properly look at what it looks like going the full toml file route.

EDIT: will know better what manages installation needs when i look at it.

[thesunilyadav]

Hi @thejamescollins,

If you're being redirected during app installation, it likely means the app is using the legacy installation flow. You can also confirm this by checking the config file. Try adding new scopes in the toml config file, if the app automatically prompts for permission when you open it, that indicates it's using the managed installation flow. Otherwise, it's on the legacy flow.

With managed installation, there's no need for redirection or manually requesting scope permissions, Shopify handles everything for us.

And yes, @Kyon147, you're absolutely right. According to Shopify, everything should now be managed through the CLI, not via the Partner Dashboard. I'm also currently using the config file and CLI for Shopify Theme Extensions and Shopify Functions (with this package). For other configurations, I still rely on the Partner Dashboard for now.

That said, it's a good idea to transition to using the CLI as soon as possible, as Shopify is clearly moving in that direction, and there's no telling when the legacy installation flow will be deprecated.

[mauveine]

I just retested this, and it's not Shopify's fault. With managed install, it simply doesn't work.

/authenticate?host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvbWFsZW9kaWxhLWFwcC1kZXY&locale=en&shop=<shop> 

It's missing the code parameter.

[Kyon147]

I just retested this, and it's not Shopify's fault. With managed install, it simply doesn't work.

/authenticate?host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvbWFsZW9kaWxhLWFwcC1kZXY&locale=en&shop=<shop> 

It's missing the code parameter.

Good find, I need to read up on the managed install as I don't know what the expectation of params and flow are. Will take a look this weekend.

[Kyon147]

It looks like managed installations require a token exchange, which makes sense why no api token is saved to the DB when you are trying to use it.

Leaving this here for reference so I can come back to it: https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/token-exchange

[thejamescollins]

If you're being redirected during app installation, it likely means the app is using the legacy installation flow. You can also confirm this by checking the config file. Try adding new scopes in the toml config file, if the app automatically prompts for permission when you open it, that indicates it's using the managed installation flow. Otherwise, it's on the legacy flow.

Our app was launched and approved 3-4 weeks ago, and has always defined the toml file, so presumably has always used managed app installations. It's strange how some installations have worked fine, and others have not.

During development I updated the app scopes, and Shopify automatically prompted my test site to approve the new scope that I added.

So it seems that I'm using Managed App Installs, but it somehow worked during app approval but is strangely not working recently.

Leaving this here for reference so I can come back to it: https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/token-exchange

Looking at those docs, it seems we'd need to implement a token exchange that requests an offline access token using the session token, and then store it in the password column in the users table?

Has anyone started work on this yet? I'm happy to do so, but I'd need a bit more guidance on this before working on it.

Thanks in advance

[thejamescollins]

Looking at the code, I'm thinking we would need to:

1. Be able to detect whether the current app is using managed app installation or not. This is so we can maintain backwards compatibility with existing apps, but support managed app installs for newer apps. Any tips on how to detect this in code would be most welcome!
2. Modify \Osiset\ShopifyApp\Http\Middleware\VerifyShopify::handleMissingToken(), so that it performs a token exchange (instead of a token redirect) if the app is using managed app install.
   It would use the token query param from the request, and perform a POST request as per these docs to request an offline access token.
   The gnikyt/Basic-Shopify-API package does not currently have code to do the token exchange, so we would do it ourselves.
   We'd then save the offline token to the users.password column.

Am I on the right track here?