So your install flow goes
app.domain.com?shop=xxxxx -> Starts auth process
app.domain.com/?code=xxxxxx&signature=xxx×tamp=xxxx&shop=xxxx
So as soon as you receive this code endpoint you can launch all your install. The code query string will never appear again as its only used during registering your app
Switch the code to be an access token -> You should have code for this already
Use the returned access token to setup webhooks
Use the returned access token to setup fulfilment service