Doing what the Shopify API can’t, safely 安全地做 Shopify API 做不到的事

The problem

In Shopify B2B, customers often place orders before their account is linked to a Company Location. Those orders are left orphaned: no corporate pricing, missing from the company’s purchase history, no unified invoicing. There can be hundreds of them.

The constraint

The problem: Shopify’s Admin API (GraphQL and REST) has no endpoint for retroactively associating existing orders with a B2B company. The only supported path is a precise sequence of clicks in the Admin UI: unlink the customer, save, re-link, and tick an “add the customer’s orders to this location” checkbox in a confirmation dialog. It can’t be scripted through the API, and it’s painfully slow by hand.

The solution: RPA that mimics the exact UI workflow

A Playwright engine drives the Admin UI through the exact 5-step wizard, triggered by a simple API call carrying a company ID and customer ID. It’s built to survive the things that break naive automation:

• Automated 2FA, without holding the client’s password long-term. When Shopify asks for a login, the script generates the current TOTP code from a secret seed (pyotp), so multi-factor auth never stalls an unattended run.
• Session persistence. After one successful login the browser state is serialized to JSON and reused, so repeated logins don’t trip Shopify’s rate limiters and CAPTCHAs.
• Selectors that survive UI changes. Buttons are found by ARIA role and label text rather than fragile CSS class names, so a Shopify UI update doesn’t quietly break the script.
• Cloud-ready. Runs headless on Browserless over a secure WebSocket, so there’s no Chrome maintenance to babysit.

The trust angle: no password sharing

Handing an automation vendor your store password and 2FA seed is a real security concern. This design keeps that exposure small: the client can switch to a one-click cookie-refresh flow, so I never need standing access to credentials. Addressing the client's security concerns is part of the deliverable, not an afterthought.

Proof

Where else this applies

Any SaaS admin task the vendor's API refuses to expose: bulk back-office edits, cross-platform syncs (Amazon, HubSpot, POS systems), migrations that only exist as a manual wizard. If your team is clicking the same sequence hundreds of times, it can be a safe, unattended script.