Doing what the Shopify API can't — safely
A browser-automation (RPA) solution that retroactively links historical customer orders to B2B Company Locations in Shopify Admin — the one workflow Shopify's API simply doesn't expose.
The problem
In Shopify B2B, customers often place orders before their account is linked to a Company Location. Those orders stay orphaned — no corporate pricing, missing from the company's purchase history, no unified invoicing. And there can be hundreds of them.
The constraint
Here's the catch: Shopify's Admin API (both GraphQL and REST) has no endpoint to retroactively associate existing orders with a B2B company. The only supported path is a precise sequence of clicks inside the Admin UI — unlink the customer, save, re-link, and tick a "add the customer's orders to this location" checkbox in a confirmation dialog. Impossible to script through the API; painfully slow by hand.
The solution: RPA that mimics the exact UI workflow
A Playwright engine drives the Admin UI through the exact 5-step wizard, triggered by a simple API call carrying a company ID and customer ID. It's built to survive the things that break naive automation:
- Automated 2FA — without ever holding the client's password long-term. When Shopify demands a login, the script generates the current TOTP code from a secret seed (pyotp), so multi-factor auth never stalls an unattended run.
- Session persistence. After one successful login the browser state is serialized to JSON and reused, so repeated logins don't trip Shopify's rate limiters and CAPTCHAs.
- Anti-breakage selectors. Buttons are found by ARIA role and label text, not by fragile CSS class names — so a Shopify UI redeploy doesn't silently break the script.
- Cloud-ready. Runs headless on Browserless over a secure WebSocket, so there's no Chrome maintenance to babysit.
The trust angle: no password sharing
Handing an automation vendor your store password and 2FA seed is a real security worry. This design minimizes that: the client can rotate to a one-click cookie-refresh flow, so I never need standing access to credentials. Solving the client's security anxiety is part of the deliverable — not an afterthought.
Proof
Verified in a sandbox before any production run. Delivered with a technical design & verification document: the full 5-step UI sequence, a sequence diagram of the login/2FA/retry flow, the anti-breakage selector strategy, and a sandbox verification report confirming the end-to-end association succeeds and the success toast is detected. The mechanics are proven before touching a live store.
Where else this applies
Any SaaS admin task the vendor's API refuses to expose: bulk back-office edits, cross-platform syncs (Amazon, HubSpot, POS systems), migrations that only exist as a manual wizard. If your team is clicking the same sequence hundreds of times, it can be a safe, unattended script.
If a machine you build needs an interface, a device connection, or data that has to land somewhere else, tell me what it's costing you now. You'll get an honest read on whether it's solvable, and usually something running to look at. Start here →