Show Install (Claim Page)
GET/api/shopify/install/:claimToken
PUBLIC (no authentication). Reveals the Shopify store being connected on the claim page after an App Store cold install.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
The opaque claimToken in the path IS the credential — it is minted after OAuth and redirected to app.sku.io/connect/shopify?claim=<token>. This endpoint deliberately exposes only the shop's display identity and lifecycle status; the stashed offline token, scopes, shop email/country, and all internal ids are NEVER returned.
Throttled to 30 req/min to blunt token-guessing.
Response fields (under data):
- shop_domain (string): the *.myshopify.com domain being connected.
- shop_name (string): the shop's display name (or a humanized subdomain fallback).
- status (string): lifecycle status — one of pending_auth, awaiting_claim, claiming, claimed, claim_failed, failed, expired, abandoned.
Returns 404 when the token matches nothing (invalid or already-consumed).
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.