improvement(credentials): actionable Shopify admin-token rejection message by waleedlatif1 · Pull Request #5891 · simstudioai/sim

waleedlatif1 · 2026-07-23T18:01:11Z

Summary

When Shopify rejects a custom-app Admin API token, the connect modal now tells the user what to check instead of a vague "double-check it in Shopify". Root cause of the field reports (verified against prod logs + a live Shopify probe) is a real 401 from Shopify — the user pasted the API key/secret key instead of the shpat_ Admin API access token, or a token bound to a different store.
Added an optional per-provider invalidCredentialsHelp override on the token service-account descriptor; set it for Shopify to name the exact fix (copy the shpat_ Admin API access token from the app's "API credentials" tab, confirm the app is installed, token must match the store domain).
Moved the error-code → message mapping out of the shared connect modal into the descriptor module (getTokenServiceAccountErrorMessage) so provider-specific copy is inherited from the definition rather than hard-coded in the modal. The modal now just unwraps the API error shape and delegates.
No change to validation logic — it was already correct.

Type of Change

Improvement

Testing

Added unit tests for the mapper (Shopify override, generic fallback, every error code, unknown/absent code). All 30 credential-area tests pass.
Verified the validator's real behavior against live Shopify: nonexistent store → 404 → site_not_found; real store + bad token → 401 → invalid_credentials.
Typecheck clean on changed files; Biome + check:api-validation pass.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-07-23T18:01:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 23, 2026 6:07pm

cursor · 2026-07-23T18:01:22Z

PR Summary

Low Risk
User-facing copy and a small refactor only; credential verification behavior is unchanged.

Overview
Centralizes token service-account connect-modal error copy in the descriptor module and adds Shopify-specific guidance when verification returns invalid_credentials.

The shared connect modal no longer embeds error-code mapping; it passes the API error.code into getTokenServiceAccountErrorMessage, which uses each provider’s tokenNoun, serviceLabel, and an optional invalidCredentialsHelp override. Shopify’s descriptor sets that override to call out the common mistake (API key/secret vs shpat_ Admin API token, store domain, revocation).

Unit tests cover the mapper for Shopify override, generic fallback, known codes, and unknown/missing codes.

^{Reviewed by Cursor Bugbot for commit b61c36a. Configure here.}

greptile-apps · 2026-07-23T18:04:19Z

Greptile Summary

The PR centralizes token service-account error messaging and adds actionable Shopify-specific invalid-token guidance.

Adds an optional provider-level invalidCredentialsHelp override.
Delegates connect-modal error mapping to the descriptor module.
Adds unit coverage for provider overrides, known error codes, and fallback behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/token-service-accounts/descriptors.ts	Adds provider-specific invalid-credentials guidance and centralizes verification error-code mapping.
apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/token-service-account-modal.tsx	Replaces local error-message mapping with the shared descriptor-based mapper.
apps/sim/lib/credentials/token-service-accounts/descriptors.test.ts	Covers Shopify-specific guidance, generic provider behavior, known codes, and fallback cases.

_{Reviews (2): Last reviewed commit: "improvement(credentials): actionable Sho..." | Re-trigger Greptile}

…ssage Shopify custom-app token verification faithfully surfaces a real 401 from Shopify, but the generic 'double-check it in Shopify' copy didn't tell users what to check. The #1 real cause is pasting the wrong secret (API key / API secret key) instead of the shpat_ Admin API access token, or using a token bound to a different store. - Add an optional per-provider invalidCredentialsHelp override on the token service-account descriptor; set it for Shopify to name the exact fix. - Move the error-code to message mapping out of the shared connect modal into the descriptor module (getTokenServiceAccountErrorMessage) so provider copy is inherited from the definition rather than hard-coded in the modal. - Add unit tests for the mapper (override, fallback, all codes).

waleedlatif1 · 2026-07-23T18:07:30Z

@greptile

waleedlatif1 · 2026-07-23T18:07:31Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b61c36a. Configure here.}

greptile-apps Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/token-service-accounts/descriptors.ts Outdated

waleedlatif1 force-pushed the worktree-shopify-admin-token-audit branch from b2602ed to b61c36a Compare July 23, 2026 18:07

vercel Bot temporarily deployed to Preview July 23, 2026 18:07 Inactive

cursor Bot reviewed Jul 23, 2026

View reviewed changes

waleedlatif1 merged commit 44749b8 into staging Jul 23, 2026
15 checks passed

waleedlatif1 deleted the worktree-shopify-admin-token-audit branch July 23, 2026 18:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

improvement(credentials): actionable Shopify admin-token rejection message#5891

improvement(credentials): actionable Shopify admin-token rejection message#5891
waleedlatif1 merged 1 commit into
stagingfrom
worktree-shopify-admin-token-audit

waleedlatif1 commented Jul 23, 2026

Uh oh!

vercel Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

waleedlatif1 commented Jul 23, 2026

Uh oh!

waleedlatif1 commented Jul 23, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Jul 23, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Jul 23, 2026

Uh oh!

waleedlatif1 commented Jul 23, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 23, 2026 •

edited

Loading

cursor Bot commented Jul 23, 2026 •

edited

Loading

greptile-apps Bot commented Jul 23, 2026 •

edited

Loading