# Installation and setup

> Installation requirements for a Shoplazza App: authenticate with OAuth immediately on Add App, request only necessary permissions, and guide merchant setup.

These requirements ensure that merchants can quickly set up and begin using your app. The installation requirements outline the proper flows for authentication, app install charges, and any required sign-up steps. Adhering to these standards guarantees that merchants receive clear guidance and support as they familiarize themselves with your app.

## 1. Authentication

1. When a merchant clicks **Add App** from your[ app's listing ](/docs/app/getting-started/create-public-app/create-app#manage-listings)page, your app must **immediately authenticate using[OAuth](/api/oauth-access-scopes)** before any other actions, even if the merchant has previously installed and uninstalled your app.

![](https://cnres.appracle.com/7dd954d67f8ea2e2d8077c1f68946e80.png "app-store-add-app.png")

2. A merchant must be able to authenticate for using your app on multiple stores, even if they share the same email address.

## 2. Permissions

Permissions define the levels of access your app has to a merchant's store through the API. The permissions that you request are shown to the merchant on the [OAuth](/api/oauth-access-scopes) handshake page, where the merchant can either grant or decline them.

![](https://cnres.appracle.com/91c5b9a706490c9b0e97dc0ad6521d3b.png "app-permission.png")

1. Merchants must be redirected to your app’s user interface (UI) immediately after they accept permission access on the OAuth handshake page.
2. Your app should request only the permissions that are essential for its functionality.
3. API permissions for your app should only be revoked using the **delete button** provided on the app setup page..

## 3. Setup and Merchant Workflows

1. Your app must provide clear in-app setup instructions tailored specifically for **Shoplazza merchants**, even if your app also connects to other platforms. These instructions should guide merchants on how to use your app effectively.

2. Your app must never ask merchants generate or provide a private API key. The [Shoplazza App Store](https://shoplazza.app/?utm_source=dev_center) supports only **public apps**.

3. Any connection that your app makes from its UI to either link to another shop or install other apps must be routed through the[ Shoplazza App Store listing ](/docs/app/getting-started/create-public-app/create-app#manage-listings)first.

4. For merchant security, your app must not use pop-up windows for essential app functionality, like running [OAuth](/api/oauth-access-scopes). Eliminating pop-ups also protects your app from interference caused by pop-up blockers.