How to Get a Shopify Access Token for Custom App Development

Creating a Shopify access token is essential for developers and business owners who want to build custom applications, integrate third-party services, or automate workflows with their Shopify store. Whether you're developing a custom app to manage inventory, sync data across platforms, or create a unique customer experience, understanding how to generate and manage API tokens is crucial.

In 2026, Shopify's authentication system continues to evolve, but the fundamental process of obtaining an access token remains straightforward. This comprehensive guide walks you through every step of the process, from preparation to implementation.

What You Need

• A Shopify store with admin access (required to create custom apps)
• Access to your Shopify Admin dashboard
• Basic understanding of APIs and how authentication tokens work
• A text editor or IDE for storing and managing your token securely
• Knowledge of your specific use case and required API scopes
• A development environment or server where you'll use the token
• Familiarity with REST APIs or GraphQL (depending on your implementation)
• Secure password management tools for storing sensitive credentials

Required API Scopes

API scopes define what permissions your custom app has when interacting with your Shopify store. Before creating a token, you must specify which scopes your app needs. Including unnecessary scopes violates the principle of least privilege and poses security risks.

Scope	What It Allows
read_products	Read access to product information, variants, and metadata. Essential for apps that display or analyze product data without modifying it.
write_products	Full access to create, update, and delete products. Required for inventory management, bulk editing, or product synchronization tools.
read_orders	Read access to order data, customer information, and transaction details. Necessary for reporting, analytics, and fulfillment integrations.
write_orders	Ability to modify orders, create fulfillments, and update order notes. Required for custom order management and fulfillment automation systems.
read_customers	Access to customer profiles, contact information, and purchase history. Essential for CRM integrations and customer analytics applications.

Step-by-Step Guide

Step 1: Log Into Your Shopify Admin Dashboard

First, navigate to your Shopify store's admin panel by going to https://admin.shopify.com and signing in with your admin credentials. Make sure you have the appropriate permissions to create custom apps—typically, only store owners or admins with app management access can perform this task.

Step 2: Navigate to the Custom Apps Section

Once logged in, follow these navigation steps:

• In the left sidebar, scroll down and click on Settings
• From the Settings menu, select Apps and integrations
• Click on Develop apps at the top of the page
• If you haven't enabled custom app development, you'll see a toggle to activate it—enable it now

Step 3: Create a New App

On the "Develop apps" page, click the Create an app button. A modal will appear asking for your app name. Choose a descriptive name that clearly indicates the app's purpose (e.g., "Inventory Sync Tool" or "Email Marketing Integration"). Click Create app to proceed.

Step 4: Configure API Scopes

After creating your app, you'll be taken to the app configuration page. Here's where you specify which API scopes your app needs:

• Click on the Configuration tab
• Scroll to the Admin API access scopes section
• Review the list of available scopes and check only those your app requires
• Be cautious: only request scopes absolutely necessary for your app's functionality
• Click Save to apply your scope selections

Step 5: Generate Your Access Token

With scopes configured, you're ready to generate your token:

• Navigate to the Credentials tab on your app's configuration page
• In the Admin API access token section, click Reveal token
• Your token will be displayed—this is your API access token
• Copy the entire token immediately and store it in a secure location

Important Security Note: Your access token is like a password. Never share it publicly, commit it to version control, or expose it in client-side code. Treat it with the same care you would treat your store's admin password.

Step 6: Test Your Token with an API Call

Before deploying your token to production, verify it works correctly by making a test API call. Here's an example using curl to retrieve your store's information:

curl -X GET "https://YOUR_STORE.myshopify.com/admin/api/2025-01/shop.json" \
  -H "X-Shopify-Access-Token: YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

Replace YOUR_STORE with your actual store name (without the .myshopify.com part) and YOUR_ACCESS_TOKEN with the token you just generated.

If successful, you'll receive a JSON response containing your store's details, including name, address, and other metadata. A 401 status code indicates an invalid token, while a 403 code means your scopes don't permit the requested action.

Step 7: Implement Your Token Securely

Now that your token is working, implement it in your application using best practices:

• Use Environment Variables: Store your token in a .env file (never commit to Git), then load it into your application via environment variables
• Add Rate Limiting: Implement exponential backoff and request throttling to avoid hitting Shopify's API rate limits
• Enable Logging: Log API requests for debugging without exposing tokens in logs
• Set Up Monitoring: Monitor your API usage to detect unusual activity that might indicate token compromise

Using GetShopifyToken (Faster Method)

While the manual process outlined above is straightforward, developers often appreciate faster automation. GetShopifyToken (https://getshopifytoken.com) streamlines the token generation process, eliminating manual steps and reducing setup time. The platform automates scope configuration and token validation, making it ideal for developers managing multiple Shopify stores or those who frequently create test applications.

By using GetShopifyToken, you can obtain a working access token in minutes rather than navigating through multiple admin dashboard pages. This service is particularly valuable for agencies and development teams handling numerous store integrations.

Common Issues

• 401 Unauthorized Error: This typically means your access token is invalid, expired, or incorrectly formatted. Verify you've copied the entire token correctly and that it's being sent in the X-Shopify-Access-Token header.
• 403 Forbidden Error: Your token lacks the necessary permissions (scopes) for the requested action. Return to your app's Configuration tab and add the required scopes.
• Can't Find the "Develop Apps" Option: Ensure you have admin access and that custom app development is enabled in your store's settings. Reach out to your store owner if you lack necessary permissions.
• Token Not Displaying: If the token doesn't appear after clicking "Reveal token," try refreshing the page or creating a new app. If the issue persists, contact Shopify support.
• Rate Limiting Errors: Shopify enforces API rate limits (typically 2 requests per second). Implement request queuing and backoff strategies in your application.
• Token Accidentally Exposed: If you've compromised your token, immediately regenerate it by deleting the old app and creating a new one with a fresh token.

Related Guides

• How to Use Shopify GraphQL API for Advanced Queries and Mutations
• Best Practices for Securing Your Shopify API Credentials and Tokens
• Building a Custom Shopify App: Complete Developer Tutorial

Frequently Asked Questions

Q: Do I need a Shopify Partner account to create an access token?

No. You can generate access tokens directly from any Shopify store where you have admin access. A Partner account is only necessary if you're building public apps for the Shopify App Store. For private, custom apps serving your own store or specific clients, you only need admin permissions on the store itself.

Q: How long do Shopify access tokens remain valid?

Shopify access tokens remain valid indefinitely unless you explicitly revoke them by deleting the associated custom app. Unlike OAuth tokens, which may expire, admin API tokens generated through custom apps don't have an expiration date. However, you should rotate tokens periodically as a security best practice, especially if you suspect any compromise.

Q: Can I use the same access token across multiple Shopify stores?

No. Each access token is specific to the store where it was created. If you manage multiple Shopify stores, you must generate separate tokens for each store. This isolation ensures better security and prevents cross-store data access from a single compromised token.