ClawHub · GitHub Releases · Project Page
Connect OpenClaw to Shopify with a guided setup, local secret storage, and safe read-first store access.
openclaw-shopify-manager is a Shopify skill for OpenClaw. It helps you connect a Shopify store, complete OAuth, verify webhooks, and read or update store data through a small local connector.
- connect a Shopify store to OpenClaw
- complete Shopify OAuth and store the offline token locally
- verify Shopify callbacks and webhooks
- show store info
- list and inspect products
- find a product by title or ID
- read and update blog/article content
- run the connector on a host or as a Docker sidecar
- guided setup instead of manual file juggling
- local secrets only:
SHOPIFY_API_KEY,SHOPIFY_API_SECRET, andSHOPIFY_ACCESS_TOKENstay in.env - least-privilege friendly: narrow scopes and read-first workflows
- localhost-bound connector by default
- works with real deployment shapes: host, VM, Docker, sidecar
You need:
- an OpenClaw instance
- a Shopify store or dev store
- a Shopify app with API key and secret
- a public HTTPS callback URL
- Node.js 22+
Recommended easiest path:
- connector on the host
- Tailscale on the host
- systemd on the host
Get the latest packaged skill from GitHub Releases or ClawHub.
node ./scripts/setup-runtime.mjs guided-setup --write-serviceThis creates the runtime directory:
~/oc/shopify-runtime/
config.json
.env
.gitignore
shopify-connector.mjs
shopify-connector.service
state/
logs/
Secrets stay in .env. The runtime .gitignore protects .env, state/, and logs/.
Use the values printed by the guided setup.
Typical values:
- App URL:
https://YOUR-HOST/shopify-manager - Allowed redirection URL:
https://YOUR-HOST/shopify-manager/shopify/callback
cd ~/oc/shopify-runtime
node ./shopify-connector.mjs run-server
curl http://127.0.0.1:8787/healthzExpected response:
ok
Recommended with Tailscale:
tailscale serve --https=443 /shopify-manager http://127.0.0.1:8787
tailscale funnel --https=443 oncd ~/oc/shopify-runtime
node ./shopify-connector.mjs auth-urlOpen the returned URL, approve the install, and let Shopify redirect back to your callback URL.
After success, the offline token is stored locally in .env as SHOPIFY_ACCESS_TOKEN.
cd ~/oc/shopify-runtime
node ./shopify-connector.mjs shop-info
node ./shopify-connector.mjs list-products --limit 10
node ./shopify-connector.mjs find-products --query "Winter Jacket" --limit 5
node ./shopify-connector.mjs get-product --title "Winter Jacket"cd ~/oc/shopify-runtime
node ./shopify-connector.mjs shop-infocd ~/oc/shopify-runtime
node ./shopify-connector.mjs list-products --limit 10cd ~/oc/shopify-runtime
node ./shopify-connector.mjs get-product --id gid://shopify/Product/1234567890cd ~/oc/shopify-runtime
node ./shopify-connector.mjs find-products --query "Winter Jacket" --limit 5cd ~/oc/shopify-runtime
node ./shopify-connector.mjs get-product --title "Winter Jacket"See also: examples/post-setup-usage.md
Use this if you want the simplest and most reliable path.
Recommended shape:
- connector on host
- systemd on host
- Tailscale on host
Host bootstrap helper:
bash ./skill/openclaw-shopify-manager/scripts/install-host-runtime.shUse this if OpenClaw already runs in Docker but you want the cleanest Shopify setup.
Recommended shape:
- OpenClaw in Docker
- connector on host
- Tailscale on host
Use this if you want the Shopify connector containerized too.
Files:
- compose:
examples/docker-compose.sidecar.yml - guide:
examples/docker-compose.sidecar.md
Start it with:
docker compose -f examples/docker-compose.sidecar.yml up -d- keep
SHOPIFY_API_KEYin.env - keep
SHOPIFY_API_SECRETin.env - keep
SHOPIFY_ACCESS_TOKENin.env - do not commit
.env - do not pass secrets around in docs, screenshots, or committed config
- keep the connector bound locally when possible
Available commands:
auth-urlexchange-coderun-servertestshop-infolist-productsfind-productsget-productupdate-productlist-blogslist-articlescreate-articleupdate-article
Run the doctor check:
node ./scripts/setup-runtime.mjs doctorUse this to confirm:
- runtime files exist
- secrets are present locally
- callback URL matches public base URL
- runtime
.gitignoreis protecting.env,state/, andlogs/ - Tailscale looks ready when you are using it