# Check a Shopify install signature

```http
POST https://secure.yoprint.com/v1/api/store/{team_slug}/setting/external_integration/shopify/verify-signature
```

- Status: internal: built for YoPrint's own apps, don't build on it
- API version: v1
- Operation ID: `v1_public_external_integration_shopify_verify_signature`
- Section: Team settings › [Integrations](https://developer.yoprint.com/reference/integrations.md)
- Web page: https://developer.yoprint.com/reference/integrations/v1-external-integration-shopify-verify-signature/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

> **Internal.** Built for YoPrint's own apps, not for integrations. Don't build on it; use the other operations in this section.

Built for YoPrint's web app, during a Shopify install that starts from the Shopify admin. It checks that the query string Shopify sent (`shopify_signature`, the raw query string with its `hmac`) is signed by Shopify for YoPrint's app. Returns `{"valid": true}` or 401.

## Permission

Needs the Manage Settings permission. The team owner always has it.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.

## Request body

Content type `application/json`, required.

Fields:

- `shopify_signature` (string, required): The query string Shopify added to the install link.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v1/api/store/your-team/setting/external_integration/shopify/verify-signature' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "shopify_signature": "shop=example.myshopify.com&timestamp=1700000000&hmac=EXAMPLE"
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `message` (string, required): Always `"Shopify signature is valid"`.
  - `valid` (boolean, required): Always `true`.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "message": "Shopify signature is valid",
    "valid": true
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
  - When: The signature doesn't match (`invalid_signature`). Fix: Start the install again from the Shopify admin.
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your role lacks Manage Settings. The body is `{"message": "Insufficient Permission"}`, without the error envelope. Fix: Use the key of a member whose role has Manage Settings, or the owner's.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: `shopify_signature` is missing or not a string (`validation_failed`). Fix: Send the query string Shopify added.
- `500` A business rule refused the request (see the operation's errors), or something failed inside YoPrint. Refusals use the error envelope with a code such as `action_not_allowed`; an unexpected failure answers `{"message": "Server Error"}`. Repeating a refusal gets the same answer; after an unexpected failure, read the record back before you retry a change.
  - When: The signature could not be checked (`signature_verification_error`). Fix: Start the install again.

## Notes

- AI apps (MCP connections) can't call this operation: they get 403 `agent_operation_not_available`. Use a personal API key.

## Related

- [Finish a Shopify install](https://developer.yoprint.com/reference/integrations/v1-external-integration-shopify-finalize-install.md): `POST /v1/api/store/{team_slug}/setting/external_integration/shopify/finalize-install`