shoplazza-oauth-sdk-node

Node.js OAuth SDK for Shoplazza public apps. This package ports the core flow from oauth-sdk-go into a TypeScript-first SDK with modern Node APIs, dual ESM/CJS output, and an Express demo app.

Install

npm install shoplazza-oauth-sdk-node

pnpm add shoplazza-oauth-sdk-node

yarn add shoplazza-oauth-sdk-node

Quick start

import express from "express";
import { ShoplazzaOAuthClient } from "shoplazza-oauth-sdk-node";

const oauth = new ShoplazzaOAuthClient({
  clientId: process.env.SHOPLAZZA_CLIENT_ID!,
  clientSecret: process.env.SHOPLAZZA_CLIENT_SECRET!,
  redirectUri: "https://your-app.example.com/oauth_sdk/redirect_uri",
  scopes: ["read_shop", "write_shop"]
});

const app = express();

app.get("/oauth_sdk/app_uri", (req, res) => {
  const shop = String(req.query.shop ?? "");
  if (!oauth.isValidShop(shop)) {
    res.status(400).json({ error: "Invalid shop domain" });
    return;
  }

  res.redirect(oauth.getAuthorizationUrl(shop, { state: "csrf-token" }));
});

app.get("/oauth_sdk/redirect_uri", async (req, res) => {
  const shop = String(req.query.shop ?? "");
  const code = String(req.query.code ?? "");

  if (!oauth.isValidShop(shop)) {
    res.status(400).json({ error: "Invalid shop domain" });
    return;
  }

  if (!oauth.isValidSignature(req.query as Record<string, string | string[]>)) {
    res.status(400).json({ error: "Invalid callback signature" });
    return;
  }

  const token = await oauth.exchangeToken(shop, code);
  res.json(token);
});

app.listen(8080);

API

ShoplazzaOAuthClient

import { ShoplazzaOAuthClient, SHOPLAZZA_ENDPOINT } from "shoplazza-oauth-sdk-node";

const client = new ShoplazzaOAuthClient({
  clientId: "your-client-id",
  clientSecret: "your-client-secret",
  redirectUri: "https://your-app.example.com/oauth_sdk/redirect_uri",
  scopes: ["read_shop"],
  endpoint: SHOPLAZZA_ENDPOINT
});

Config fields:

• clientId: Shoplazza app client ID
• clientSecret: Shoplazza app client secret
• redirectUri: callback URL configured in the partner dashboard
• scopes: OAuth scopes requested during installation
• domain: optional custom shop domain, defaults to myshoplaza.com
• endpoint: optional override for auth/token paths

Public methods:

• getAuthorizationUrl(shop, options?)
• exchangeToken(shop, code, options?)
• refreshToken(shop, refreshToken, options?)
• isValidShop(shop)
• isValidSignature(params)

Helpers:

• parseTokenResponseBody(body, contentType)
• isTokenValid(token)
• isValidHmacSignature(params, secret)
• isValidShopDomain(shop, domain)

Go to Node mapping

| oauth-sdk-go | oauth-sdk-node | | --- | --- | | Config | new ShoplazzaOAuthClient(config) | | AuthCodeURL(shop, opts...) | getAuthorizationUrl(shop, options?) | | Exchange(shop, code, opts...) | exchangeToken(shop, code, options?) | | RefreshToken(shop, refreshToken, opts...) | refreshToken(shop, refreshToken, options?) | | ValidShop(shop) | isValidShop(shop) | | SignatureValid(params) | isValidSignature(params) | | shoplazza.Endpoint | SHOPLAZZA_ENDPOINT |

Express demo

The repo includes an Express demo app under examples/express. It exposes the same two routes as the Go example:

• /oauth_sdk/app_uri
• /oauth_sdk/redirect_uri

Run it locally:

npm install
npm run dev:example

Environment variables:

• SHOPLAZZA_CLIENT_ID
• SHOPLAZZA_CLIENT_SECRET
• SHOPLAZZA_REDIRECT_URI
• SHOPLAZZA_SCOPES
• PORT

Development

npm install
npm test
npm run build