Connect Shopify

RedeemID talks to Shopify through three things. Set them up in this order, then enter the values in Configuration.

1. A client for sign-in

Customers sign in through Shopify’s Customer Account API, so the store needs a headless or custom app with Customer Account API access. Copy its client ID into REDEEMID_CLIENT_ID. A confidential client also has a secret for REDEEMID_CLIENT_SECRET; leave that unset for a public client.

In the client’s settings, enter these values. RedeemID → Debug prints the exact ones for your site:

Setting	Value
Callback URI	https://your-site/auth-callback/
JavaScript origin	https://your-site
Logout URI	https://your-site/

The redeemid_auth_callback_slug filter changes the callback slug. The callback is a front-end route, so the site needs pretty permalinks. The setup checklist on the RedeemID overview can create the callback page for you.

2. An Admin API app

RedeemID reads customers and their tags through the Admin API. New custom apps are made in Shopify’s Dev Dashboard; since 2026-01-01 the Shopify admin no longer creates them. Create one in the same organization as the store, with:

• Admin API scopes: read_customers and write_customers
• Redirect URL: your site’s home URL. The client credentials grant doesn’t use it, but the form requires one.

Install it on the store, then enter its client ID and secret as REDEEMID_ADMIN_CLIENT_ID and REDEEMID_ADMIN_CLIENT_SECRET. RedeemID requests short-lived Admin tokens with them. RedeemID → Debug shows the scopes Shopify granted.

3. Webhooks

Click Register webhooks with Shopify on RedeemID → Webhooks. It subscribes https://your-site/wp-json/redeemid/v1/webhooks/events to every topic RedeemID uses, through the app from step 2, so Shopify signs each delivery with that app’s client secret. Running it again only adds what is missing.

Don’t also create webhooks in Shopify’s Settings → Notifications. Those are signed with a different key and fail verification.

The topics:

• customers/create, customers/update, customers/delete, customers/enable, customers/disable and customers/merge
• customer.tags_added and customer.tags_removed
• customers_email_marketing_consent/update, customers_marketing_consent/update and customer_purchasing_summary/create
• app/uninstalled
• the compliance topics customers/data_request, customers/redact and shop/redact. Shopify doesn’t allow these through the API, so declare them in the app’s configuration. See Privacy for what each one does.

Since API 2025-01, customers/update no longer carries tags, so the two customer.tags_* topics are what make tag changes arrive quickly.

Access changes only when a webhook lands, so RedeemID watches the chain. Once a day it checks the app’s subscriptions in Shopify and re-creates any that are missing. On admin screens it flags rejected deliveries, a stuck queue, dead-lettered deliveries and a long silence.

Optional: Storefront tokens

Plan cards and buy-now need a Storefront API token from the store’s Headless channel. The public token (REDEEMID_PUBLIC_ACCESS_TOKEN) works. The private token (REDEEMID_STOREFRONT_PRIVATE_TOKEN) is recommended, because it lets buy-now send the buyer’s IP so Shopify doesn’t throttle every visitor as your server’s one address. Products must be published to the same Headless channel.