Security

Shopify OAuth sessions, HMAC-verified webhooks, and least-scope Admin API access for Order Edit.

Shopify OAuth with per-shop session storage. Embedded Admin requests authenticate before data access.

Order and compliance webhooks are HMAC-verified before processing.

Internal admin is password-gated and fail-closed when credentials are unset.