How to Get a Shopify Access Token for Custom App Development

Creating a custom app in Shopify is one of the most powerful ways to extend your store's functionality. Whether you're building internal tools, integrating third-party services, or developing custom features tailored to your business needs, you'll need a Shopify access token to authenticate your API requests. This comprehensive guide will walk you through the entire process of creating a Shopify custom app and generating your access token in 2026.

What You Need

• A Shopify store with admin access (any plan level works, but development stores are recommended for testing)
• A basic understanding of APIs and how authentication works
• Access to your Shopify admin dashboard
• Knowledge of what API scopes your app will require
• A text editor or IDE for managing your access token securely
• curl or a similar tool for testing API requests (optional but recommended)
• An understanding of your use case (inventory management, customer data, order processing, etc.)

Required API Scopes

API scopes determine what permissions your custom app has access to. Before creating your app, you need to decide which scopes you need. Here are some common scopes you might require:

Scope	What It Allows
read_products, write_products	Read and modify product information, including titles, descriptions, pricing, and variants
read_orders, write_orders	Access and modify order data, including customer information and fulfillment status
read_inventory, write_inventory	Read and update inventory levels across your store and sales channels
read_customers, write_customers	Access and modify customer profiles, addresses, and contact information
read_fulfillments, write_fulfillments	Create and manage fulfillment orders and track shipping status

Choose only the scopes your app actually needs. This follows the principle of least privilege and improves security. You can always add more scopes later if needed.

Step-by-Step Guide

Follow these detailed steps to create your Shopify custom app and obtain your access token:

Step 1: Access the Shopify Admin Dashboard

Log into your Shopify admin panel at https://admin.shopify.com. Make sure you're using an account with administrative privileges. If you don't have a development store, you can create one for free through the Shopify Partner dashboard.

Step 2: Navigate to Apps and Integrations

In your Shopify admin dashboard, look for the "Apps and integrations" section in the left sidebar menu. Click on it to expand the menu options. You should see several submenu items including "Apps and sales channels," "Develop apps," and "API credentials."

Step 3: Access the Develop Apps Section

Click on "Develop apps" to access the app development area. If this is your first time creating an app, you may need to accept terms and conditions. Shopify may also ask you to provide some basic information about your development project.

Step 4: Create Your Custom App

Click the "Create an app" button. A dialog box will appear asking for your app name. Choose a descriptive name that reflects what your app does, such as "Inventory Sync Tool" or "Customer Data Exporter." You can also add an app icon and description here, though these are optional.

Step 5: Configure Admin API Scopes

After creating your app, you'll be taken to the app configuration page. Look for the "Admin API access scopes" or "Configuration" section. Here, you'll see a list of all available API scopes. Select only the scopes your app needs. For example, if you're building an inventory management tool, select "read_inventory" and "write_inventory." Remember to save your changes.

Step 6: Generate Your Access Token

Once you've configured your scopes, look for the "API credentials" or "Admin API" section. You should see a button that says "Generate access token" or "Reveal token." Click this button to generate your access token. Shopify will create a unique token that you'll use to authenticate your API requests.

IMPORTANT: Copy your access token immediately and store it in a secure location. Shopify will only display this token once. If you lose it, you'll need to generate a new one. Never share your access token or commit it to version control systems like GitHub.

Step 7: Test Your Access Token

To verify that your access token works correctly, you can make a test API request. Here's an example using curl to fetch your store information:

curl -X GET "https://your-store.myshopify.com/admin/api/2024-01/shop.json" \
  -H "X-Shopify-Access-Token: shpat_your_access_token_here" \
  -H "Content-Type: application/json"

Replace "your-store" with your actual store name and "shpat_your_access_token_here" with your generated access token. If successful, you'll receive a JSON response containing your shop information, confirming that your token is working properly.

Step 8: Implement Environment Variables

In your application code, never hardcode your access token. Instead, use environment variables. Here's an example in Python:

import os
from shopify import Session, ShopifyResource

access_token = os.getenv('SHOPIFY_ACCESS_TOKEN')
shop_url = os.getenv('SHOPIFY_SHOP_URL')

session = Session(shop=shop_url, access_token=access_token)
ShopifyResource.activate_session(session)

Store your access token in a .env file (which you should never commit to version control) or use your hosting platform's secrets management system.

Using GetShopifyToken (Faster Method)

If you want to streamline the process of creating a custom app and managing your access tokens, consider using getshopifytoken.com. This tool automates many of the manual steps involved in creating a Shopify custom app, allowing you to generate access tokens more quickly and efficiently. Instead of navigating through multiple Shopify admin screens, you can complete the process in just a few clicks. GetShopifyToken also provides helpful documentation and keeps track of your tokens in one centralized location, making it easier to manage multiple apps and development environments.

Common Issues

• Token Not Displaying After Generation: If you can't see your access token after clicking "Generate," refresh the page or log out and back in. The token should appear in the API credentials section.
• 401 Unauthorized Errors: This typically means your access token is invalid, expired, or doesn't have the required scopes for your API request. Verify your token and ensure you've enabled the necessary scopes.
• Insufficient Permissions Error: If you receive an error about insufficient permissions, you need to add the required API scope to your app configuration and regenerate your token.
• Lost Access Token: If you've lost your access token and can't find it, you'll need to generate a new one. The old token will become invalid.
• Rate Limiting: Shopify enforces rate limits on API requests. If you exceed these limits, you'll receive a 429 error. Implement request queuing and exponential backoff in your code to handle this gracefully.
• SSL Certificate Errors: Ensure your development environment has up-to-date SSL certificates. You can test this by making a simple HTTPS request to Shopify's API.
• CORS Issues: If you're calling the Shopify API from a browser-based application, you may encounter CORS (Cross-Origin Resource Sharing) errors. Use a backend proxy to make API requests instead of calling Shopify directly from the frontend.

Related Guides

• How to Use Shopify GraphQL Admin API with Your Access Token
• Building a Shopify App: Complete Development Workflow
• Shopify API Scopes Explained: Choosing the Right Permissions for Your App

Frequently Asked Questions

Q: Can I use the same access token for multiple Shopify stores?

No. Each Shopify store requires its own access token. If you're managing multiple stores, you'll need to create separate custom apps on each store and generate individual access tokens for each one. This is a security feature that prevents one compromised token from giving access to all your stores.

Q: How long does an access token remain valid?

Shopify access tokens remain valid indefinitely until you manually revoke them or delete the associated custom app. However, it's good practice to rotate your tokens periodically as a security measure. If you suspect a token has been compromised, immediately regenerate it or delete the app.

Q: What's the difference between a custom app and a public app?

A custom app is created for a specific store and uses an access token for authentication. Custom apps are private and only work with the store they were created on. A public app, on the other hand, is listed in the Shopify App Store and uses OAuth 2.0 for authentication, allowing it to be installed on multiple stores. Choose a custom app if you're building something specific to your own business, and choose a public app if you want to distribute your solution to other Shopify merchants.