Maruf Ahmed 🇧🇩

Software Engineer at @StoreSEOapp | Shopify App Specialist | React, Node.js, TypeScript | Building Scalable Web Products

[Maruf Ahmed 🇧🇩 @mrmarufpro]

https://t.co/SE1dvLdNC2

[Maruf Ahmed 🇧🇩 @mrmarufpro]

I built a Shopify MCP OAuth flow that makes connecting an AI client feel like connecting any other app.

Merchants sign in with Shopify, choose a store, and the MCP credential is bound to it before any tool runs.

32-sec demo + open-source packages below 👇

[Maruf Ahmed 🇧🇩 @mrmarufpro]

Do you remember when you joined X? I do! #MyXAnniversary

[Maruf Ahmed 🇧🇩 @mrmarufpro]

Building an MCP server for a Shopify app?

Here’s how we combined Shopify OAuth with MCP OAuth at @StoreSEOapp so each AI client can access only the Shopify store the merchant approved.

A 4-minute read.

#ShopifyDev #MCP

https://t.co/A0YzbvWEVo

[Maruf Ahmed 🇧🇩 @mrmarufpro]

The MCP 2026-07-28 specification update prefers CIMD, with DCR retained for backward compatibility.

https://t.co/7G5OrCeCqG

[Maruf Ahmed 🇧🇩 @mrmarufpro]

There are two ways an MCP client can identify itself during OAuth.

DCR: The server stores the client metadata and issues a new client ID.

CIMD: The client publishes its metadata at an HTTPS URL, which becomes its stable client ID.

The difference, side by side.

#MCP #OAuth

[Maruf Ahmed 🇧🇩 @mrmarufpro]

OAuth is what allows an MCP client such as Claude, ChatGPT, Cursor, or VS Code to securely connect to a protected MCP server.

In Part 4A of Behind the Build, I break down the journey:
https://t.co/r3RfYrAMrB

#MCP #OAuth #AIEngineering

[Maruf Ahmed 🇧🇩 @mrmarufpro]

A missing piece in Shopify’s Node/Express stack is finally here.
https://t.co/areKbDIbBv

[Maruf Ahmed 🇧🇩 @mrmarufpro]

A missing piece in Shopify’s Node/Express stack is finally here.

Token exchange and expiring offline tokens now work in v8.0.0, opening the door for Sidekick extensions implementation.

This builds on my work in PR #3097. Thanks to Shopify for taking it forward

#ShopifyDev

[Maruf Ahmed 🇧🇩 @mrmarufpro]

https://t.co/areKbDIbBv

[Maruf Ahmed 🇧🇩 @mrmarufpro]

A missing piece in Shopify’s Node/Express stack is finally here.

Token exchange and expiring offline tokens now work in v8.0.0, opening the door for Sidekick extensions implementation.

This builds on my work in PR #3097. Thanks to Shopify for taking it forward

#ShopifyDev

[Maruf Ahmed 🇧🇩 @mrmarufpro]

A missing piece in Shopify’s Node/Express stack is finally here.

Token exchange and expiring offline tokens now work in v8.0.0, opening the door for Sidekick extensions implementation.

This builds on my work in PR #3097. Thanks to Shopify for taking it forward

#ShopifyDev

[Maruf Ahmed 🇧🇩 @mrmarufpro]

@faridmovsumov @mattdkoenig Lovely!
Which intent do you have registered your Sidekick action extension for? Is it Shopify/product?
TIA

[Maruf Ahmed 🇧🇩 @mrmarufpro]

@theo https://t.co/k3sg91EcM2

[Maruf Ahmed 🇧🇩 @mrmarufpro]

@t3dotcodes @theo @jullerino I’m authenticated using a Claude code setup token. The Providers settings indicate that I’m authenticated, but I’m unable to use it because of a failed authentication attempt.

[Maruf Ahmed 🇧🇩 @mrmarufpro]

@t3dotcodes @theo @jullerino I’m authenticated using a Claude code setup token. The Providers settings indicate that I’m authenticated, but I’m unable to use it because of a failed authentication attempt.

[Maruf Ahmed 🇧🇩 @mrmarufpro]

@thsottiaux Please increase the dictation speed. It’s quite slow for both long and short transcriptions.

[Maruf Ahmed 🇧🇩 @mrmarufpro]

🧵6/6
The split became simple:

The AI client remembers the conversation.

The product keeps the data.

The MCP server connects the two and does the work.

[Maruf Ahmed 🇧🇩 @mrmarufpro]

The MCP server could have kept its own copy of every conversation.

But once I mapped out where the information already lived, that felt unnecessary. 🧵1/6

#MCP #Backend #Engineering #shopifydev

[Maruf Ahmed 🇧🇩 @mrmarufpro]

🧵5/6
It did not need another copy of every message or result. Each call could start fresh.

That is what stateless means here.