Disclaimer and how it works

Last updated 2026-10-26

valorant shop (xhv.sh/valorant-shop) is an independent, fan-made tool that helps VALORANT players view their own in-game shops. It shows your daily weapon skin offers, accessory shop and Night Market, keeps a wishlist, sends Discord notifications, and lets you share a shop view with friends in read-only mode.

Not affiliated with Riot Games. valorant shop is not affiliated with, endorsed by, sponsored by or officially supported by Riot Games, Inc. VALORANT and Riot Games are trademarks or registered trademarks of Riot Games, Inc. This project was created under no Riot Games program and uses no Riot-issued approval.

What it does and does not do

It reads shop and account information that belongs to you and shows it to you.
It does not sell VALORANT Points or skins, buy anything, process in-game purchases, or change your shop offers.
It does not touch the game client, game memory or game files, and it does not automate gameplay.
It does not ask for your Riot password.

How it works

1. Sign-in on Riot's own page

To link a Riot account, the website builds a sign-in link to auth.riotgames.com. You enter your password and any 2FA code on that Riot-hosted page. Your password is never submitted to xhv.sh. The sign-in uses the OAuth 2.0 authorization code flow with PKCE, bound to a DPoP key (RFC 9449) so tokens cannot be replayed from another client.

2. The redirect URL

After you sign in, Riot sends your browser to http://localhost/redirect?.... That page cannot load, which is expected. The address contains a one-time authorization code. You copy the full address and paste it into the website, which exchanges the code for tokens.

Never share this URL with anyone else. It contains temporary authentication data. Pasting it into this site, once, while linking your own account, is the only intended use. If someone else asks you for it, do not send it.

3. What is stored

Data	Why
Discord ID, display name, avatar (Discord sign-in, `identify` scope only)	Identify your dashboard session and send you DMs
Riot player ID, display name, region	Know which account and shard to query
Riot access and refresh tokens, encrypted with AES-256-GCM before they are saved	Fetch your shop later, including for scheduled alerts, without asking you to sign in again
Cached shop data, wishlist, alert settings, share codes (stored as an HMAC digest, not in plain text)	Features you turn on

The database is only reachable with a server-side service key. Sessions use an httpOnly cookie. The site loads no third-party scripts and no analytics. Item images are loaded from valorant-api.com and Discord's CDN.

4. What it requests from Riot

Using your tokens, the server makes read-only requests to the same regional player-data services the game client uses: your storefront (daily, accessory, Night Market and bundle offers), wallet balances, competitive rank, account level, owned items and equipped loadout. These are undocumented, unofficial endpoints, which means Riot can change or block them at any time without notice.

5. Sharing

A share code gives someone a read-only view of one account's shop. The recipient never receives your tokens or password. You can revoke a code or remove a recipient at any time.

6. Removing your data

Removing an account in the dashboard deletes the stored tokens and data for that account from our database. Settings also has Delete all my data, which permanently removes every account, token, alert setting, wishlist entry and share code you have. Anyone you shared an account with loses access immediately. You can also change your Riot password and sign out of your Riot sessions at any time. If you want everything deleted, message @xhvsh on Discord.

Legal status and Riot's rules

valorant shop is provided for informational and convenience purposes. No representation is made that its functionality is approved or authorized by Riot Games, or that its use is permitted under every applicable law, regulation or Riot Games policy.

The sign-in method and the player-data endpoints are not part of an official, published Riot developer program for this purpose. Riot maintains its own Terms of Service and rules for third-party applications and account access, and those rules can change. You are responsible for reading and following them before using this service.

As of the date above, the operator has not received any notice, request or enforcement action from Riot Games about this service, and is not aware of any account action taken against users because of it. That is a statement of observation only. It is not permission, approval or a guarantee, and it can change at any time.

Risks

Policy risk. Riot could decide that third-party shop viewers break its rules and act against the service or against accounts linked to it. Using this service is at your own discretion and risk.
Changing how it works raises the risk. This service only reads your data. Forking, self-hosting or modifying a tool like this so that it buys items, automates requests at high volume, interacts with the game client, or accesses accounts that are not yours is a different activity. It is much more likely to be treated as a rules violation or to cause account penalties, and it is not covered by anything on this page.
Token security. A stored refresh token grants access to your Riot session until it expires or is revoked. We encrypt it and limit access, but no system is perfectly secure. Do not link accounts you cannot afford to risk.
Availability. The service may change, break or shut down at any time because of technical, legal or policy developments.

Independence

By using this service you acknowledge that it is an independent third-party project, that Riot Games is not responsible for its operation, availability or support, and that it is provided as is, without warranties of any kind, to the extent permitted by law.

Questions, bugs or removal requests: @xhvsh on Discord.