diff --git a/app/Http/Controllers/ShopifyInstallController.php b/app/Http/Controllers/ShopifyInstallController.php
new file mode 100644
index 0000000..6f207fa
--- /dev/null
+++ b/app/Http/Controllers/ShopifyInstallController.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
+
+class ShopifyInstallController extends Controller
+{
+    private string $clientId;
+    private string $clientSecret;
+    private string $shop;
+    private string $scopes = 'read_products,read_inventory,read_orders';
+
+    public function __construct()
+    {
+        $this->clientId     = '1b6430c8cc94b5e58716235abd9bbd73';
+        $this->clientSecret = config('services.shopify.webhook_secret');
+        $this->shop         = 'bluefootedboobyspices.myshopify.com';
+    }
+
+    public function install()
+    {
+        $url = "https://{$this->shop}/admin/oauth/authorize"
+            . "?client_id={$this->clientId}"
+            . "&scope={$this->scopes}"
+            . "&state=spicesetup";
+
+        return redirect($url);
+    }
+
+    public function callback(Request $request)
+    {
+        $code = $request->query('code');
+
+        if (!$code) {
+            return response('Kein Code empfangen. ' . $request->getQueryString(), 400);
+        }
+
+        $response = Http::post("https://{$this->shop}/admin/oauth/access_token", [
+            'client_id'     => $this->clientId,
+            'client_secret' => $this->clientSecret,
+            'code'          => $code,
+        ]);
+
+        if ($response->failed()) {
+            return response('Token-Exchange fehlgeschlagen: ' . $response->body(), 500);
+        }
+
+        $token = $response->json('access_token');
+
+        return response("<pre>SHOPIFY_ACCESS_TOKEN={$token}</pre>");
+    }
+}
diff --git a/routes/web.php b/routes/web.php
index 11fa2c8..a7114f5 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,7 +1,12 @@
 <?php
 
+use App\Http\Controllers\ShopifyInstallController;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/', function () {
     return redirect('/dashboard', 301);
 });
+
+// Temporär: einmalige Shopify OAuth-Installation
+Route::get('/shopify/install',  [ShopifyInstallController::class, 'install']);
+Route::get('/shopify/callback', [ShopifyInstallController::class, 'callback']);