Shopify API key

Shopify's credential docs state the rule that goes with the names: "Your client ID is safe to include in frontend code. Your client secret must never be exposed to the browser or included in client-side code"¹. An API key on its own tells Shopify which app is asking. It gives no access to any store's data.

The token goes in the X-Shopify-Access-Token header². The Storefront API, which headless builds such as Hydrogen storefronts read from, uses separate tokens and separate headers: X-Shopify-Storefront-Access-Token for public tokens and Shopify-Storefront-Private-Token for private ones.

For SEO work, the usual reason to want a token is a bulk edit the admin doesn't offer, such as setting the seo.hidden metafield across hundreds of products. Redirects are the exception: the admin's CSV import handles most bulk redirect jobs with no API access at all.

1. Open the Dev Dashboard at dev.shopify.com/dashboard. Go to Apps, click Create app, choose Start from Dev Dashboard, name the app and click Create⁵.
2. On the Versions tab, set the app URL, pick a Webhooks API version and select the access scopes the app needs. Click Release⁵.
3. On the app's Home page, scroll to Install app, pick the store and click Install⁵.
4. Under Settings, copy the Client ID and Client secret from the Credentials section¹. Store them as environment variables, never in a file you might commit⁴.
5. Post them to the store's token endpoint and send the token you get back with every Admin API request⁶.

curl -X POST "https://{shop}.myshopify.com/admin/oauth/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$SHOPIFY_CLIENT_ID" \
  -d "client_secret=$SHOPIFY_CLIENT_SECRET"

# Response
# {"access_token": "your-token", "scope": "read_products", "expires_in": 86399}

curl -X POST "https://{shop}.myshopify.com/admin/api/2026-07/graphql.json" \
  -H "Content-Type: application/json" \
  -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN" \
  -d '{"query": "{ shop { name } }"}'

This client credentials grant only works when the app and the store belong to the same Shopify organization⁴. For someone else's store you need the authorization code grant or custom distribution with token exchange, and Shopify recommends Shopify CLI for apps built for other merchants⁶.

Not everyone on a store can do this. Store owners can create custom apps by default. Staff need the App development > Develop permission, and collaborator accounts can't open the Dev Dashboard at all⁷. If an agency is doing the work on a collaborator account, the store owner has to create the app or grant a staff account.

Their credentials are under Apps > Develop apps > [your app] > API credentials⁸. The Admin API access token was shown once, when it was generated. If nobody saved it, the only way to get another is to uninstall and reinstall the app, which breaks API requests and webhooks until your code has the new token. You can't rotate the API key or secret on these apps either.

• Keep secrets in environment variables or a secrets manager and never commit them to version control¹.
• Never put the secret or a token in a theme file or a script tag. Anything Liquid outputs ends up in the visitor's browser.
• Ask for the fewest scopes the job needs. A token reads exactly what its scopes allow², so a leaked read_products token exposes your catalog, while a leaked token with order and customer scopes exposes your customers.
• Rotate the client secret on a schedule, and straight away if you think it leaked. Tokens minted under the old secret stop working once you revoke it¹.
• Custom apps that need Level 2 personal data ("Custom Level 2 PII apps" in Shopify's terms) require the Grow plan or higher. Moving to Basic removes that access⁷.

A tutorial that sends you to Develop apps to create a new app, or that builds on REST endpoints, predates at least one of these changes. On 16 September 2026 the newest GraphQL Admin API version listed on shopify.dev was 2026-07¹⁰.

• Liquid: theme code that runs on Shopify's servers without any API key.
• Web Bot Auth: HTTP message signatures that authenticate your own crawlers, a separate credential from anything on this page.
• Currency format: prices you read through the API come back as amounts, and the store's format decides how the storefront prints them.
• Hydrogen SEO: the headless setup that runs on Storefront API tokens.