Testing oAuth login flow

I'm creating a shopify app. I've written express middleware that will take a shop via query parameter so the route with "/?shop=example-shop" will kick off the login flow, from there the user gets redirected to shopify where if they aren't already logged in they do so then "install" the app, approving my apps keys. Then they get sent back to the app where I exchange the code for an access token and do other things like store the user. There's a lot that happens when they come back to the server and I'm having trouble deciding how to test everything. For one I can't even test this route unless all of the returned params are valid (signature, hmac, timestamp).

I'm thinking I could use Casper to login to shopify and follow the flow.

How can I test this very complicated login flow, with valid get parameters?

All the local stuff is easy to test, like database calls. However I can't fake / mock keys and the access token exchange.