The REST Admin API is a legacy API as of October 1, 2024. Starting April 1, 2025, all new public apps must be built exclusively with the GraphQL Admin API. For details and migration steps, visit our migration guide.
Storefront
You can use the StorefrontAccessToken resource to generate storefront access tokens. Storefront access tokens are used to delegate unauthenticated access scopes to clients that need to access the unautheticated Storefront API. A sales channel can generate a storefront access token and then pass it to a consuming client, such as JavaScript or a mobile application.
Storefront access tokens are allocated on a per shop basis, and an application can have a maximum of 100 active Storefront access tokens per shop.
A storefront access token inherits all of the unauthenticated access scopes from the app that creates it. If the app has not been granted any unauthenticated access scopes, then creating the storefront access token will fail.
Endpoints
- post/admin/api/latest/storefront_
access_ tokens. json Creates a new StorefrontAccessToken - get/admin/api/latest/storefront_
access_ tokens. json Retrieves a list of storefront access tokens that have been issued - del/admin/api/latest/storefront_
access_ tokens/{storefront_ access_ token_ id}. json Deletes an existing storefront access token
The StorefrontAccessToken resource
Properties
Unique id that identifies a token and is used to perform operations on it.
The issued public access token.
An application-dependant, comma separated list of permissions associated with the token.
The date and time when the public access token was created. The API returns this value in ISO 8601 format.
An arbitrary title for each token determined by the developer/application, used for reference purposes.
No constraint on uniqueness.
The StorefrontAccessToken resource
Anchor to POST request, Creates a new StorefrontAccessTokenpostCreates a new Storefront
Creates a new storefront access token
Create a new storefront access token
Create a new storefront access token
Show storefront_access_token properties
An arbitrary title for each token determined by the developer/application, used for reference purposes.
No constraint on uniqueness.
Creating a token after exceeding the limit fails
Creating a token after exceeding the limit fails
Show storefront_access_token properties
An arbitrary title for each token determined by the developer/application, used for reference purposes.
No constraint on uniqueness.
Generating a token for an app that lacks required unauthenticated scopes fails
Generating a token for an app that lacks required unauthenticated scopes fails
Show storefront_access_token properties
An arbitrary title for each token determined by the developer/application, used for reference purposes.
No constraint on uniqueness.
/admin/api/2025-07/storefront_
Response
examples
Create a new storefront access token
curl -d '{"storefront_access_token":{"title":"Test"}}' \ -X POST "https://your-development-store.myshopify.com/admin/api/2025-07/storefront_access_tokens.json" \ -H "X-Shopify-Access-Token: {access_token}" \ -H "Content-Type: application/json"const { admin, session } = await authenticate.admin(request); const storefront_access_token = new admin.rest.resources.StorefrontAccessToken({session: session}); storefront_access_token.title = "Test"; await storefront_access_token.save({ update: true, });# Session is activated via Authentication test_session = ShopifyAPI::Context.active_session storefront_access_token = ShopifyAPI::StorefrontAccessToken.new(session: test_session) storefront_access_token.title = "Test" storefront_access_token.save!// Session is built by the OAuth process const storefront_access_token = new shopify.rest.StorefrontAccessToken({session: session}); storefront_access_token.title = "Test"; await storefront_access_token.save({ update: true, });response
HTTP/1.1 200 OK{"storefront_access_token":{"access_token":"93781b58aa32d226961b449333894a65","access_scope":"unauthenticated_read_product_listings","created_at":"2025-07-01T14:31:03-04:00","id":1003304090,"admin_graphql_api_id":"gid://shopify/StorefrontAccessToken/1003304090","title":"Test"}}Creating a token after exceeding the limit fails
curl -d '{"storefront_access_token":{"title":"Token"}}' \ -X POST "https://your-development-store.myshopify.com/admin/api/2025-07/storefront_access_tokens.json" \ -H "X-Shopify-Access-Token: {access_token}" \ -H "Content-Type: application/json"const { admin, session } = await authenticate.admin(request); const storefront_access_token = new admin.rest.resources.StorefrontAccessToken({session: session}); storefront_access_token.title = "Token"; await storefront_access_token.save({ update: true, });# Session is activated via Authentication test_session = ShopifyAPI::Context.active_session storefront_access_token = ShopifyAPI::StorefrontAccessToken.new(session: test_session) storefront_access_token.title = "Token" storefront_access_token.save!// Session is built by the OAuth process const storefront_access_token = new shopify.rest.StorefrontAccessToken({session: session}); storefront_access_token.title = "Token"; await storefront_access_token.save({ update: true, });response
HTTP/1.1 400 Bad Request{"errors":["Api permission exceeds public access token limit of: 100"]}Generating a token for an app that lacks required unauthenticated scopes fails
curl -d '{"storefront_access_token":{"title":"Test"}}' \ -X POST "https://your-development-store.myshopify.com/admin/api/2025-07/storefront_access_tokens.json" \ -H "X-Shopify-Access-Token: {access_token}" \ -H "Content-Type: application/json"const { admin, session } = await authenticate.admin(request); const storefront_access_token = new admin.rest.resources.StorefrontAccessToken({session: session}); storefront_access_token.title = "Test"; await storefront_access_token.save({ update: true, });# Session is activated via Authentication test_session = ShopifyAPI::Context.active_session storefront_access_token = ShopifyAPI::StorefrontAccessToken.new(session: test_session) storefront_access_token.title = "Test" storefront_access_token.save!// Session is built by the OAuth process const storefront_access_token = new shopify.rest.StorefrontAccessToken({session: session}); storefront_access_token.title = "Test"; await storefront_access_token.save({ update: true, });response
HTTP/1.1 403 Forbidden{"errors":"App must be extendable to create a storefront access token."}
Anchor to GET request, Retrieves a list of storefront access tokens that have been issuedgetRetrieves a list of storefront access tokens that have been issued
Retrieves a list of storefront access tokens that have been issued
Retrieve a list of storefront access tokens that have been issued
Retrieve a list of storefront access tokens that have been issued
/admin/api/2025-07/storefront_
Response
examples
Retrieve a list of storefront access tokens that have been issued
curl -X GET "https://your-development-store.myshopify.com/admin/api/2025-07/storefront_access_tokens.json" \ -H "X-Shopify-Access-Token: {access_token}"await admin.rest.resources.StorefrontAccessToken.all({ session: session, });# Session is activated via Authentication test_session = ShopifyAPI::Context.active_session ShopifyAPI::StorefrontAccessToken.all( session: test_session, )// Session is built by the OAuth process await shopify.rest.StorefrontAccessToken.all({ session: session, });response
HTTP/1.1 200 OK{"storefront_access_tokens":[{"access_token":"378d95641257a4ab3feff967ee234f4d","access_scope":"unauthenticated_read_product_listings","created_at":"2025-07-01T14:28:21-04:00","id":755357713,"admin_graphql_api_id":"gid://shopify/StorefrontAccessToken/755357713","title":"API Client Extension"}]}
Anchor to DELETE request, Deletes an existing storefront access tokendelDeletes an existing storefront access token
Deletes an existing storefront access token
Delete an existing storefront access token
Delete an existing storefront access token
/admin/api/2025-07/storefront_
Response
examples
Delete an existing storefront access token
curl -X DELETE "https://your-development-store.myshopify.com/admin/api/2025-07/storefront_access_tokens/755357713.json" \ -H "X-Shopify-Access-Token: {access_token}"await admin.rest.resources.StorefrontAccessToken.delete({ session: session, id: 755357713, });# Session is activated via Authentication test_session = ShopifyAPI::Context.active_session ShopifyAPI::StorefrontAccessToken.delete( session: test_session, id: 755357713, )// Session is built by the OAuth process await shopify.rest.StorefrontAccessToken.delete({ session: session, id: 755357713, });response
HTTP/1.1 200 OK