How a Shopify embedded inventory app works: install, sessions and permissions
What happens when you install an embedded Shopify app: managed installation, session tokens instead of passwords, the permissions it asks for, and what to check before you approve one.
Stokrio Team · · 7 min read
An embedded Shopify app is one that opens inside your Shopify admin instead of on another website. For an inventory app, that changes three things you care about: how you sign in, what the app is allowed to see, and how you are billed. This guide explains each, using Stokrio as the worked example, so you can judge any app the same way.
Key takeaways
- An embedded app signs you in with Shopify, not with a new password. Check that it does not also ask you to create a separate account.
- Permissions ("scopes") are approved at install. Read what each one is for, and be wary of write access you cannot explain.
- Billing for a Shopify-installed app should run through Shopify and appear on your Shopify invoice.
- A good app tells you what it does when a browser blocks the cookies Shopify's embedded frame relies on.
Installing: managed installation and session tokens
When you install from Shopify, Shopify itself handles the installation and shows you the permissions the app requests. Once approved, the app is opened inside an iframe in your admin. The app does not know who you are yet, so it asks Shopify's front-end library (App Bridge) for a session token: a short-lived, signed statement that this request comes from this store and this staff member.
The app's server checks the signature using its secret, and only then trusts the request. Stokrio does exactly this: the session token signs the store in, and it is exchanged for the store's access token to call Shopify's API. There is no password to create, and no box asking you to type your shop's address.
Permissions: what each one is for
Shopify permissions are specific. Stokrio asks for:
| Permission | Why an inventory app needs it |
|---|---|
| Read products | The catalogue, variants and barcodes to forecast and reorder |
| Read orders | Sales to forecast demand, and shipping details to pick, pack and label |
| Read inventory | Stock levels, kept in step as they change |
| Read and write merchant-managed fulfilment orders | So a pack station can mark an order fulfilled with tracking |
A fifth, longer order history, is optional and approved separately by Shopify. The pattern to copy when you evaluate any app: for each permission, can you name the feature that needs it? If not, ask.
Tokens and where they live
The access token the app holds is the key to your store's data, so how it is stored matters. Shopify's newer tokens expire and are refreshed. Stokrio stores them encrypted, never shows them again after they are saved, and refreshes them before they run out.
Cookies inside the iframe
Browsers increasingly restrict cookies in embedded frames, which can break sign-in inside the Shopify admin. Stokrio sets its session cookie as a partitioned cookie for the admin frame, and if a browser blocks it anyway, it says so and offers to open the app in its own tab rather than failing silently.
Billing
Apps installed from Shopify are expected to charge through Shopify's Billing API. You approve the charge on Shopify's own page, it appears on your Shopify invoice, and you can change or stop it without giving the app your card. Stokrio's two plans work this way, monthly or annual.
What to check before approving any embedded app
- Does installing sign you in, or does it also demand a separate account?
- Can you name the feature behind each permission?
- Is billing through Shopify, with the price visible before you approve?
- What happens on uninstall, and what happens to your data?
- Do your staff get their own logins, or do they share yours?
See how this looks in practice on the Shopify app page.