Nothing in BoostEcom works on a hypothesis about your store. Every System, every specialist and every number reads a connected store, so this is the first step and it is the one that decides what the AI can see.
Path 1 — connect a store you already run
The standard Shopify OAuth install. You approve a set of scopes, and
those scopes are a hard ceiling: no System, no tool and no agent can
reach past them. Approving read_products but not read_orders means
the Conversion Analyzer works from the catalogue and says what it could
not see, rather than inferring the missing half.
The access token is encrypted at rest with AES-256-GCM. It is never returned by an API, never logged, and never shown in the dashboard.
Which Shopify grant opens which capability is listed in MCP tools & scopes. The same catalogue gates the agent tools and the MCP server, so there is one answer, not two.
Path 2 — have one provisioned
If you do not have a store yet, the wizard claims one from a pre-provisioned pool of Shopify development stores.
The pool exists because of a platform limit, not a design preference:
Shopify's public Partner API has no devStoreCreate mutation, so a
store cannot be created on demand by anyone. Ops pre-creates them; the
wizard claims one atomically in milliseconds, faster than a creation
call would have been if one existed.
If the pool is empty the flow continues and you are waitlisted rather than blocked, and ops is alerted.
The ownership transfer
A development store has to become yours, and Shopify does not expose that by API either. The transfer is triggered from the Partner Dev Dashboard; you receive an email, and you have 7 days to accept and pick a paid plan.
The state machine is CLAIMED → TRANSFER_REQUESTED → TRANSFERRED.
Acceptance is detected automatically by polling shop.plan_name: a
development store answers partner_test or affiliate, and anything
else means a real plan, so the transfer went through.
The connection survives the transfer. The custom app installed before the handoff keeps working for the new owner, so there is no re-authorization step after you accept. The problem is solved upstream rather than patched afterwards.
After the launch
The store wizard materialises 29 milestones: 13 run automatically, 16 are guided one-click checkpoints. The split is not laziness: every third-party app install goes through the merchant's own OAuth, by Shopify's anti-abuse rules, so no platform can automate it. Everything else (theme, products, collections, pages, menus, blog, legal pages, SEO) is automated.
The launch-tick cron runs every 15 minutes: it executes the automatic
milestones in dependency order and detects transfer acceptances.
Disconnecting
POST /api/integrations/shopify/revoke ends the connection. For what
happens to the data afterwards, including the Shopify-mandated erasure
webhooks — see Data & privacy.