Hi Brandon,
In step #4, the full list of parameters is:
- code
- shop
- timestamp
- signature
When someone installs your app and uses it later by clicking on the link from the 'Apps' panel in the admin, they will be sent to your apps Callback URL, with the following parameters:
- shop
- timestamp
- signature
The API token that you received during the installation of the app can be used for that shop until it removes your app. You'll just have to look up the token associated with the shop.
Sorry about the wait on the answer for this. Let me know if you have any questions.
Nate