HANGER SHOPIFY APP — REGISTRATION AND LAUNCH
19 October 2026

IMPLEMENTED
Standalone Shopify merchant dashboard at:
https://hanger-try-on-backend.muxidada.chatgpt.site/shopify/app
OAuth authorization-code installation with state/cookie/HMAC validation.
Encrypted offline tokens with expiring-token refresh support.
Separate merchant sessions, shop balances and test/live credit wallets.
100 credits/$10, 500/$47, 1000/$90 via Shopify one-time app purchases.
Credit grants require authoritative Shopify ACTIVE confirmation; duplicates do not grant twice.
Signed app-proxy storefront launches bind anonymous shoppers and generation spending to the installed shop. Merchants do not share the original demo backend balance.
Uninstall revocation and signed compliance webhooks, with stale uninstall/redaction protection.
Theme app extension with selected-variant image selection and a hosted fitting room.

CURRENT REGISTRATION STATUS
Registered app: Hanger Virtual Try-On, app ID 437110112257.
Developer organization: T & M Corporation, ID 241610576.
Dashboard: https://dev.shopify.com/dashboard/241610576/apps/437110112257
Client ID: 07d3bc04ef2aa6e3c1f20a724cd0ac6e (public identifier).
Client secret: connected to the hosted backend's encrypted owner configuration; never included in this package.
Released extension version: hanger-0-1-3, version ID 1172540719105. Official CLI theme checks passed.
Development store: Hanger Try-On Test, https://admin.shopify.com/store/hanger-try-on-test
The app is installed and connected; its block is saved on the test theme. Public distribution is selected. A Shopify TEST purchase was approved without billing and reconciled as ACTIVE with 100 test credits. Reloading the payment return kept the balance at 100. Full fitting-room/generation validation is not yet complete. App Store registration requires business declarations, agreement acceptance and a one-time $19 fee before submission. No registration payment or App Store submission was made.
The official Shopify CLI is installed in the workspace package. C:\Hanger-Shopify contains the distributable files and package-lock.json; run npm ci there to install its CLI dependencies when using that copy. Preserve the registered shopify.app.toml and generated extension UID for updates.

NEXT STEPS WITH YOUR SHOPIFY DEVELOPER ACCOUNT
1. Sign into https://dev.shopify.com/dashboard in Edge. Create the developer/Partner organization if needed; complete its account/terms steps yourself.
2. Create/select the Hanger app using Shopify CLI or the Dev Dashboard. For App Store distribution, keep it as a public-distribution app, not a custom-distribution app locked to one merchant. Select public distribution only when the intended distribution choice is clear in the dashboard.
3. Obtain the registered app's Client ID and Client secret. Save them under Shopify app setup in the Hanger owner's /admin page, with Test Shopify billing checked. The secret is encrypted and is not placed in the theme package.
4. From this folder, create the local app configuration with the real public Client ID:
   node configure-shopify.mjs YOUR_REAL_CLIENT_ID
   This creates shopify.app.toml from shopify.app.toml.example. If an actual Shopify-generated configuration already exists, preserve its identity and merge the provided URLs/scopes/proxy/webhook settings into it deliberately instead of overwriting it.
5. npm ci
   npm run shopify -- auth login
   npm run shopify -- app deploy
   Sign in when CLI asks, select the registered Hanger app, inspect the release and preserve any Shopify-generated extension UID. Deploying the hosted Worker does not upload the theme extension to Shopify; this CLI step does.
6. Create a Shopify development store from the Dev Dashboard. Install the registered app using its dashboard install link. Hanger's Connect your shop flow uses the permanent *.myshopify.com address and redirects through Shopify approval.
7. In the merchant dashboard, use Add the product-page button, or open the theme editor on a product template and add Hanger · Try it on. Save and preview. Confirm selected variant images work on the target theme.
8. Make Shopify TEST purchases for all three packs. Confirm prices, ACTIVE confirmation and the correct shop/test balance. Generate one intentional test image only when ready: Shopify test billing is free, but fal generation uses real owner credits.
9. Test a second development shop to confirm balance isolation, then exercise declined charges, duplicate notifications, reconnect, uninstall and reinstall. Development shops always use test billing.
10. Before public launch, supply verified business/support contact details, merchant-facing refund/support terms, privacy information for the actual business and provider retention settings, and App Store listing screenshots. Complete Shopify's automated/manual review and fix any findings. App approval cannot be guaranteed by the code or its local tests.
11. Only after live readiness, uncheck Test Shopify billing in owner settings and explicitly confirm live purchases. Non-development stores then approve real Shopify charges. No merchant purchase is approved automatically.

APP CONFIGURATION
Application URL:
https://hanger-try-on-backend.muxidada.chatgpt.site/shopify/app
Embedded: false (standalone app with OAuth)
Required scope: write_app_proxy
OAuth callback:
https://hanger-try-on-backend.muxidada.chatgpt.site/api/shopify/callback
App proxy URL:
https://hanger-try-on-backend.muxidada.chatgpt.site/api/shopify/proxy
App proxy prefix: apps
App proxy subpath: hanger
Storefront launch path: /apps/hanger/launch
API version: 2026-10
Webhook URL:
https://hanger-try-on-backend.muxidada.chatgpt.site/api/shopify/webhooks
Topics: app/uninstalled, app_purchases_one_time/update
Compliance topics: customers/data_request, customers/redact, shop/redact
Privacy draft:
https://hanger-try-on-backend.muxidada.chatgpt.site/shopify/privacy.html

Optional private hosting overrides:
SHOPIFY_CLIENT_ID
SHOPIFY_CLIENT_SECRET
SHOPIFY_TEST_MODE=true (literal false for live non-development-store charges)
When environment overrides are used, deploy after changing them. Never put the client secret, fal key or merchant access tokens in browser/theme code.

DIRECT DEMO VERSUS INSTALLED APP
Custom-Liquid-button.liquid remains a direct-demo integration that does not require a registered Shopify app. It uses the original Hanger testing/shared balance and does not identify a merchant tenant. The registered extension block uses the signed Shopify proxy and each shop's isolated credits. Do not distribute the demo snippet as a substitute for the registered app's tenant/billing flow.

VALIDATION COMPLETED LOCALLY
TypeScript checks and automated tests simulate Shopify and fal endpoints against the real migrated SQLite schema. Tests cover OAuth state/HMAC/cookies/scope, encryption, tenant isolation, CSRF, idempotent one-time purchase creation, authoritative confirmation, duplicate billing notifications, separate test/live balances, forced development-store testing, interrupted purchase recovery, signed proxy launches, per-shop credit spending/job privacy, uninstall revocation/replay protection and redaction isolation. These do not replace actual Shopify installation, CLI deployment, theme rendering or App Store review.

REFERENCE
https://shopify.dev/docs/apps/build/authentication-authorization/authenticate-standalone-apps
https://shopify.dev/docs/apps/build/online-store/theme-app-extensions/build
https://shopify.dev/docs/apps/launch/billing/manual-pricing/support-one-time-purchases

