diff --git a/src/document/openapi/en/components_order.yml b/src/document/openapi/en/components_order.yml
index 682cd86f2..e9f7a5617 100644
--- a/src/document/openapi/en/components_order.yml
+++ b/src/document/openapi/en/components_order.yml
@@ -51,6 +51,7 @@ orderWithChannel:
           enum:
             - Alipay
             - Wechat
+            - AlipayPlus
       type: object
       required:
         - channel
diff --git a/src/main/java/au/com/royalpay/payment/manage/merchants/core/impls/ClientManagerImpl.java b/src/main/java/au/com/royalpay/payment/manage/merchants/core/impls/ClientManagerImpl.java
index c67591083..8f672722b 100644
--- a/src/main/java/au/com/royalpay/payment/manage/merchants/core/impls/ClientManagerImpl.java
+++ b/src/main/java/au/com/royalpay/payment/manage/merchants/core/impls/ClientManagerImpl.java
@@ -2700,16 +2700,27 @@ public class ClientManagerImpl implements ClientManager, ManagerTodoNoticeProvid
     public void writeAggregatePoster(JSONObject manager, String clientMoniker, OutputStream ous) {
         JSONObject client = clientDetail(manager, clientMoniker);
         try {
-            logger.debug("downloading aggregate poster from {}", clientMoniker);
+            String url = PlatformEnvironment.getEnv().concatUrl("/static/images/new_aggregate_poster.png");
+            logger.debug("downloading aggregate poster from {}--{}", clientMoniker, url);
             HttpRequestResult boardBackgroundResult = new HttpRequestGenerator(
-                    PlatformEnvironment.getEnv().concatUrl("/static/images/new_aggregate_poster.png"), RequestMethod.GET).execute();
+                    url, RequestMethod.GET).execute();
             if (boardBackgroundResult.isSuccess()) {
-                InputStream ins = boardBackgroundResult.getResponseContentStream();
-                BufferedImage background = ImageIO.read(ins);
-                IOUtils.closeQuietly(ins);
-                ImageIO.write(background, "jpeg", ous);
-                ous.flush();
-                IOUtils.closeQuietly(ous);
+                try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
+                    InputStream ins = boardBackgroundResult.getResponseContentStream();
+                    BufferedImage background = ImageIO.read(ins);
+                    IOUtils.closeQuietly(ins);
+                    logger.debug("aggregate image size {}x{}", background.getWidth(), background.getHeight());
+                    BufferedImage img = new BufferedImage(background.getWidth(), background.getHeight(), BufferedImage.TYPE_3BYTE_BGR);
+                    Graphics g = img.getGraphics();
+                    g.drawImage(background, 0, 0, null);
+                    g.dispose();
+                    ImageIO.write(img, "jpeg", bos);
+                    bos.flush();
+                    byte[] imageBytes = bos.toByteArray();
+                    logger.debug("aggregate image length {}", imageBytes.length);
+                    ous.write(imageBytes);
+                    IOUtils.closeQuietly(ous);
+                }
             } else {
                 logger.error("get aggregate poster file failed:[{}]-{}", boardBackgroundResult.getStatusCode(),
                         boardBackgroundResult.getResponseContentString(), boardBackgroundResult.getException());
diff --git a/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/service/ShopifyRequestValidator.java b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/service/ShopifyRequestValidator.java
index cf90d7473..6a37029d0 100644
--- a/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/service/ShopifyRequestValidator.java
+++ b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/service/ShopifyRequestValidator.java
@@ -21,9 +21,11 @@ public class ShopifyRequestValidator {
         return HmacVerificationUtil.hmacSHA256(message.toString(),clientSecret,parameter.getHmac());
     }
 
-    public boolean verifyPermission(String shopifyStoreHost, String hmac, String timestamp) {
+    public boolean verifyPermission(String shop, String hmac, String timestamp, String host) {
         StringBuilder message =new StringBuilder();
-        message.append("shop=").append(shopifyStoreHost)
+        message
+                .append("host=").append(host)
+                .append("&shop=").append(shop)
                 .append("&timestamp=").append(timestamp);
         return HmacVerificationUtil.hmacSHA256(message.toString(),clientSecret,hmac);
     }
diff --git a/src/main/java/au/com/royalpay/payment/manage/shopify/auth/web/ShopifyAuthTemplateController.java b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/web/ShopifyAuthTemplateController.java
index c57b68a81..29c1f22d0 100644
--- a/src/main/java/au/com/royalpay/payment/manage/shopify/auth/web/ShopifyAuthTemplateController.java
+++ b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/web/ShopifyAuthTemplateController.java
@@ -38,13 +38,14 @@ public class ShopifyAuthTemplateController {
      */
     @GetMapping("/auth")
     @ShopifyEndpoint
-    public String shopifyStorePermission(@RequestParam("shop") String shop,
-                                         @RequestParam("hmac") String hmac,
+    public String shopifyStorePermission(@RequestParam("hmac") String hmac,
+                                         @RequestParam("host") String host,
+                                         @RequestParam("shop") String shop,
                                          @RequestParam("timestamp") String timestamp) {
         if (!Pattern.matches("^[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.myshopify\\.com", shop)) {
             throw new BadRequestException("Parameter shop is invalid.");
         }
-        if (!shopifyRequestValidator.verifyPermission(shop, hmac, timestamp)) {
+        if (!shopifyRequestValidator.verifyPermission(shop, hmac, timestamp,host)) {
             throw new ShopifyRequestVerifyException("This request parameters is invalid");
         }
         ShopifyPermissionURL shopifyPermissionURL = shopifyMerchantAuthApplication.getShopifyPermissionUrl(shop);