Documentation

Requirements

• An eligible Shopify store with Shopify B2B enabled.
• New customer accounts enabled for company users.
• An Online Store 2.0 theme that supports app blocks.
• At least one Shopify company, location, buyer contact, and approver contact for testing.

1. Install and review permissions

Install OrderQuorum from Shopify and review the requested company, customer, order, product, app proxy, and Function access. The read_products scope is used only when a buyer submits a cart: it confirms that each ProductVariant ID exists and reads product and variant titles, SKU, and product ID for the request snapshot and classification. Prices and totals in that snapshot are submitted by the storefront. The app does not modify products, read Shopify product prices, verify submitted prices against Shopify, or reprice lines. The other permissions support identity, approval workflow records, checkout enforcement, and order completion status.

2. Configure the purchase policy

In Shopify Admin, open OrderQuorum → Purchase policy. Enable approvals, choose the default cart-value threshold, decide whether PO numbers are required, and configure an optional PO prefix and validation pattern. Save the policy before testing.

3. Assign company roles

Company contacts appear after their first authenticated OrderQuorum action. Before submitting a request, have both the buyer and approver sign in to new customer accounts and open OrderQuorum purchase approvals once. Then open Companies & roles, save the default roles for the company, and assign:

• Buyer to the company contact who creates the cart.
• Approver to a different contact authorized to approve the test amount.

Both contacts must belong to the same Shopify company location. An approver limit below the submitted total prevents approval. If a matched company or location rule requires an Approver role, the contact must hold that active role. OrderQuorum does not assign or notify a named person.

4. Add the cart block

1. Open Online Store → Themes → Customize.
2. Open the active cart template.
3. Add app block → B2B purchase approval.
4. Place it near the cart totals and checkout action.
5. Save the theme.

5. Add customer account surfaces

In the customer account editor, add the OrderQuorum purchase approvals full page and the company profile block. The profile block gives company users a direct route to Needs your approval and My purchase requests.

6. Run an end-to-end test

1. Sign in as the buyer and build a cart above the threshold.
2. Enter a valid PO number and buyer note, then select Request approval.
3. Sign in as the approver, open OrderQuorum purchase approvals from the company profile, and use Needs your approval.
4. Review the displayed product details, quantities, request total, PO, and note; approve the request.
5. Return to the buyer account, restore the approved variants and quantities, and continue to checkout.
6. Complete checkout with the approved PO number.
7. Confirm the request becomes Checked out in OrderQuorum Admin.

7. Test enforcement

Keep the cart at or above the global threshold, repeat the test, and change an approved variant, quantity, subtotal, currency, company location, or PO number. Shopify should block checkout when the approval is missing or expired, or when one of those checked fields differs from the grant. Also test a missing PO, invalid prefix, rejection reason, and a cart below the threshold.

Audit exports

Open Audit log, search by request, company, actor, or comment, filter by event type, and download CSV. Stored events have no merchant-facing edit action. They may be changed by privacy redaction or deleted under the configured retention policy, so this history is not an external immutable audit store. Spreadsheet-formula prefixes are escaped for safer review.

Uninstall and data requests

Uninstall from Shopify Admin to stop the service. Customer access, redaction, and shop deletion requests are handled through Shopify’s mandatory privacy webhooks. Completed rejected, expired, withdrawn, and checked-out requests are removed with their full event history after the retention period configured in Settings (180 days by default). Draft, pending, approved, and changes-requested records are not removed by the retention worker. A pending customer data request pauses cleanup until its report is fulfilled. Customer redaction clears the mapped Shopify customer ID, display name, email, and buyer note; replaces the Shopify company-contact ID with a salted pseudonymous value; and disables the local member. It clears all event comments on that customer's submitted requests and comments or labels on events attributed to that member, then rebuilds each affected event chain. The pseudonymous member record and its role and location relationships remain until shop deletion; retained request relationships follow request retention. Free text on unrelated requests is not semantically searched for indirect mentions and may remain until aggregate deletion under the retention policy; retained free text is not presumed anonymous.