Check a Shopify install signature

POST/v1/api/store/{team_slug}/setting/external_integration/shopify/verify-signature

v1InternalOperation ID v1_public_external_integration_shopify_verify_signature

Internal

Built for YoPrint's own apps, not for integrations. It is listed so the reference is complete; don't build on it, and use the other operations in this section.

Built for YoPrint's web app, during a Shopify install that starts from the Shopify admin. It checks that the query string Shopify sent (shopify_signature, the raw query string with its hmac) is signed by Shopify for YoPrint's app. Returns {"valid": true} or 401.

Permission

Needs the Manage Settings permission. The team owner always has it.

Path parameters

• team_slugstringrequired

  Your team slug, shown as Team ID next to your API key in Profile.

  • Example your-team

Request body

application/json, required.

• shopify_signaturestringrequired

  The query string Shopify added to the install link.

Response

200Successful response.

• dataobjectrequired
  Child fields (2)

  • messagestringrequired
    • Always "Shopify signature is valid"
  • validbooleanrequired
    • Always true
• statusintegerrequired
• successbooleanrequired

Errors

• 401The API key is missing or wrong (unauthenticated).

  When

  The signature doesn't match (invalid_signature).

  Fix

  Start the install again from the Shopify admin.

• 403You are not allowed to do this. api_access_not_in_plan: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only {"message": "Insufficient Permission"}. Other refusals use the error envelope, with unauthorized or user_is_not_authorized.

  When

  Your role lacks Manage Settings. The body is {"message": "Insufficient Permission"}, without the error envelope.

  Fix

  Use the key of a member whose role has Manage Settings, or the owner's.

• 404Not found. page_not_found: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. code: null, with a message that starts "No query results for": there is no record with that id.

• 422The request was refused and changed nothing. validation_failed lists what to fix in error.fields; other codes name a business rule, explained in error.message. A few checks answer with only {"message": "..."}. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer connect_timeout ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.

  When

  shopify_signature is missing or not a string (validation_failed).

  Fix

  Send the query string Shopify added.

• 500A business rule refused the request (see the operation's errors), or something failed inside YoPrint. Refusals use the error envelope with a code such as action_not_allowed; an unexpected failure answers {"message": "Server Error"}. Repeating a refusal gets the same answer; after an unexpected failure, read the record back before you retry a change.

  When

  The signature could not be checked (signature_verification_error).

  Fix

  Start the install again.

Notes

• AI apps (MCP connections) can't call this operation: they get 403 agent_operation_not_available. Use a personal API key.

Related

• POSTFinish a Shopify install/v1/api/store/{team_slug}/setting/external_integration/shopify/finalize-install

Example request

curl

curl -X POST 'https://secure.yoprint.com/v1/api/store/your-team/setting/external_integration/shopify/verify-signature' \  -H 'Authorization: Bearer YOUR_API_KEY' \  -H 'Accept: application/json' \  -H 'X-Yoprint-Decimal-Format: exact-v1' \  -H 'Content-Type: application/json' \  -d '{    "shopify_signature": "shop=example.myshopify.com&timestamp=1700000000&hmac=EXAMPLE"  }'

Example response 200

Response

{
  "data": {
    "message": "Shopify signature is valid",
    "valid": true
  },
  "status": 200,
  "success": true
}