APIs for apps
Your app's code runs in a few different places: on your own backend or storefront, in extensions that Shopify renders, and in Shopify Functions that run inside Shopify. Each place has its own kind of API, with its own authentication and limits.
This page organizes Shopify's APIs by where the code that calls them runs, so you can find the right one for what you're building. The full API reference has the schemas and every field.
Anchor to GraphQL APIsGraph
These APIs are GraphQL endpoints that you send HTTP requests to. Some can be called only from your backend, because they authenticate with a secret token that the merchant granted your app. Others support public clients, so a browser or a mobile app can query them directly.
| API | Use it for | Called from | Authenticated as |
|---|---|---|---|
| GraphQL Admin API | Reading and writing store data: products, orders, customers, inventory, metafields. The primary API for most apps. | Your backend | The app, with an access token and the access scopes the merchant granted |
| Storefront API | Buyer-facing storefronts and carts, including headless and custom storefronts. | A browser or mobile app with public access, or your backend with private access | A public or private storefront token |
| Customer Account API | Logged-in buyer data: order history, profile, addresses. | A public client (web or mobile, using PKCE) or a confidential client on your backend | The buyer, through customer accounts |
| ShopifyQL | Analytics queries against store data, in an SQL-like language. | Your backend, through the GraphQL Admin API | The app |
| Payments Apps API | Payments partners resolving and rejecting payment sessions. | Your backend | The payments app |
| Partner API | Your own Partner organization data, such as app installs and payouts. | Your backend | Your Partner organization |
The REST Admin API is legacy. New apps should use the GraphQL Admin API, which is where new features ship.
The REST Admin API is legacy. New apps should use the GraphQL Admin API, which is where new features ship.
Anchor to Webhooks and eventsWebhooks and events
Instead of polling for changes, your app subscribes to them. Shopify sends each change to an endpoint that you own, and your app verifies and processes the delivery.
- Webhooks are the production mechanism today. Subscribe to a topic, and Shopify posts each change to your endpoint.
- Events is the successor to webhooks, in developer preview on the
unstableAPI version for a subset of topics. It adds triggers that narrow deliveries and a GraphQL query that shapes each payload. Use it for early testing, and keep webhooks for the topics it doesn't cover yet. - App Events flow in the other direction: your app reports its own activity, and each event lands in the Dev Dashboard alongside your webhook and Function logs.
Anchor to Extension APIsExtension APIs
An app extension is code that Shopify renders inside its own UI. Each surface gives extensions a JavaScript API scoped to what that surface can do, such as reading the current order, adding a banner, blocking progress, or opening a modal. Shopify authenticates those calls for you, so there's no token to manage, and you build the UI itself from Polaris web components.
| Surface | Extension API | Fetching more data |
|---|---|---|
| App Home, embedded in the admin | App Bridge, or App Home UI extensions for extension-only apps | The GraphQL Admin API from front-end code, in both models |
| Admin actions, blocks and print actions | Admin extensions API | Direct API access to the GraphQL Admin API, and an authorization header added for you on any fetch() to your app's own URL |
| Checkout and Thank you | Checkout UI extensions API | A session token the extension attaches to calls to your own backend, which your server verifies before it trusts the request |
| Customer accounts | Customer account UI extensions API | A session token, verified by your server the same way |
| Point of Sale | POS UI extensions API | The Direct Access API for the GraphQL Admin API, and a session token for calls to your own backend |
| Online store | Liquid in a theme app extension, rather than a JavaScript API. Product metafields and shop metaobjects are available in the render | The Ajax API or the Storefront API, for anything fetched after the page loads |
| Storefront analytics | Web Pixels API |
Anchor to Function APIsFunction APIs
A Shopify Function runs inside Shopify's backend during operations like checkout and cart calculations, where a network call would be too slow. Because of that, Functions don't call APIs over the network by default.
Instead, you declare an input query against the Shopify Function APIs schema for your target. Shopify runs the query, passes the result to your WebAssembly module as JSON, and expects a typed result back. There's no endpoint, no token, and no rate limit.
If your Function needs external data, then use network access. You describe the HTTP request in a fetch target, and Shopify performs the request, retries it on transient failures, and passes the response to your run target. Shopify enables network access for each target individually, so check the availability table for the target you're building.
Anchor to Next stepsNext steps
- Make your first authenticated call in the Build an app tutorial.
- Understand how your app gets an access token and which scopes it needs.
- Review API usage for the behaviors that are specific to Shopify's GraphQL APIs, including rate limits, global IDs, and versioning.
- Browse the GraphQL Admin API reference for the objects, queries, and mutations available to your app.