The Authentication Nightmare No One Warns You About
Managing auth across three systems is a nightmare. You're dealing with Shopify's OAuth that seems to expire whenever it feels like it, Claude API keys that you will definitely commit to GitHub by accident, and React session state that breaks if users look at it wrong.
What goes wrong:
- Shopify OAuth tokens just fucking die randomly with zero warning
- Claude API bills spike to insane amounts - mine hit $2,100 the first month because I forgot to cache anything like a complete moron
- React state management becomes a clusterfuck with async data flying around from three different APIs
- Mobile auth is somehow even worse - React Native deep linking works great until it doesn't, usually right before demo day
What Actually Works (After Breaking Everything)
Skip headless unless you're doing serious volume
Everyone's obsessed with headless Shopify like it's magic. Shopify's docs basically admit it's overkill for most stores. Standard themes work fine and you won't spend months building basic functionality.
Claude models - what actually works:
- Haiku: Use this for product descriptions and simple stuff. Way cheaper than the bigger models
- Sonnet: Decent for customer service when Haiku isn't smart enough
- Opus: Way too expensive for most stuff, only used it a few times when I really needed the smart one
React Native is pure suffering:
Sounds amazing in theory - write once, run everywhere. Reality: I spent 3 fucking weeks debugging iOS push notifications that worked perfectly on Android. Found out it was some esoteric provisioning profile bullshit that Apple's docs never mention. Platform-specific differences are everywhere - UI, navigation, fonts, literally everything behaves differently. Even Shopify's mobile team admits they're still fighting this shit after years.
The Shit That Actually Breaks
Webhooks will ruin your life
Shopify webhooks fail silently all the goddamn time. No error, no retry, they just fucking disappear into the void. I missed 200 orders during our Black Friday sale because webhooks just stopped firing. No logs, no nothing. Found out when customers called asking about their confirmation emails. I had to build monitoring that checks for missing webhooks - it's basically screaming at me 24/7 now.
// This will save your sanity - webhook verification
const verifyWebhook = (data, signature) => {
const hmac = crypto.createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET);
const body = JSON.stringify(data);
const hash = hmac.update(body, 'utf8').digest('base64');
return timingSafeEqual(Buffer.from(hash), Buffer.from(signature));
};
Claude API rate limiting sucks
Their docs are misleading about rate limits. You'll hit them way before the numbers they claim, especially with concurrent requests. Add exponential backoff or your app will break randomly.
React performance is terrible at scale
Past 10,000+ products, React becomes unusably slow without virtualization. React Window fixed it but took me forever to get working right. There are also other approaches like pagination and infinite scroll.
What this actually costs
Monthly bills for a decent-sized store (prepare your credit card):
- Shopify Plus: $2,000/month (need Plus for proper API access)
- Claude API: varies like a bipolar crypto chart - sometimes $600, sometimes $1,400, once hit $2,100 when I left a loop running overnight
- Vercel hosting: $250-400/month for the React app because their free tier is a joke
- Monitoring/webhook/Redis stuff: $100-200/month, more when everything's on fire
Total: $3,000+ most months and that's before you pay anyone to actually build this thing.
What I'd Do Differently
Start simpler: Build on standard Shopify themes first, add Claude integration, then consider custom React if you actually need it.
Budget 3x your time estimates: This integration took our team 6 months, not the 6 weeks we originally planned. Check out this guide about upcoming Shopify API changes that might break your stuff.
Implement monitoring from day one: You need to know when webhooks fail, when Claude API is slow, and when your React app crashes. Sentry and custom monitoring saved my sanity. Performance monitoring is crucial for React apps at scale.
Have a rollback plan: When this integration breaks (not if, when), you need to be able to disable Claude features without breaking core commerce functionality.
The next section covers the specific implementation that actually works in production.