Shopify Admin API Token Setup

What Changed

As of January 1, 2026, Shopify deprecated legacy custom apps. You can no longer create apps that show a static shpat_ token to copy-paste. The new Dev Dashboard gives you a Client ID and Client Secret which you exchange programmatically for a short-lived access token (24hr expiry).

1 Create & Install the App

Open the Dev Dashboard

Create a New App

Configure the App Version

App URL: Leave as https://example.com — doesn't matter for API-only use.

Scopes: Click Select scopes or paste directly into the Scopes text box:

read_products,write_products,read_metaobjects,write_metaobjects,read_metaobject_definitions,write_metaobject_definitions,read_files,write_files,read_inventory,write_inventory,read_themes,write_themes,read_online_store_pages,write_online_store_pages,read_content,write_content

Click the Release button (bottom-right).

Install on Your Store

2 Get Your Credentials

Your .env file

3 Request an Access Token

Exchange your credentials for a short-lived access token. This replaces the old copy-paste shpat_ flow.

PowerShell

cURL

Expected Response

{
  "access_token": "f85632530bf277ec9ac6...",
  "scope": "read_products,write_products,...",
  "expires_in": 86399
}

The access_token is your Admin API token. Use it in the X-Shopify-Access-Token header. Expires in 24 hours.

4 Auto-Refreshing Auth Module (Node.js)

For scripts that run repeatedly, use a shared auth module that fetches and caches the token automatically.

auth.js

import 'dotenv/config';
import { URLSearchParams } from 'node:url';

const SHOP = process.env.SHOPIFY_SHOP;
const CLIENT_ID = process.env.SHOPIFY_CLIENT_ID;
const CLIENT_SECRET = process.env.SHOPIFY_CLIENT_SECRET;

let token = null;
let tokenExpiresAt = 0;

export async function getToken() {
  if (token && Date.now() < tokenExpiresAt - 60_000) return token;

  const response = await fetch(
    `https://${SHOP}.myshopify.com/admin/oauth/access_token`,
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'client_credentials',
        client_id: CLIENT_ID,
        client_secret: CLIENT_SECRET,
      }),
    }
  );

  const { access_token, expires_in } = await response.json();
  token = access_token;
  tokenExpiresAt = Date.now() + expires_in * 1000;
  return token;
}

Usage in any script

import { getToken } from './auth.js';

const token = await getToken();
// Use in X-Shopify-Access-Token header

package.json

{
  "name": "shopify-tooling",
  "type": "module",
  "private": true,
  "dependencies": {
    "dotenv": "^16.4.0"
  }
}

Run npm install in your project folder, then node test-auth.js to verify.

5 Troubleshooting

Error: app_not_installed

Your .myshopify.com subdomain doesn't match the store the app is installed on. Check Settings → Domains in your store admin for the correct subdomain.

Error: shop_not_permitted

The app and store are in different Shopify organizations. Client credentials only works within the same org.

Only seeing shpss_ token, no shpat_

The shpss_ is your Client Secret, not an access token. You must exchange it programmatically (see Part 3).

Token expired

Tokens last 24 hours. Use the auto-refreshing auth module (Part 4) or re-run the token request.

6 Quick Reference