Skip to main content

Generate access tokens for admin-created custom apps

Caution

You can no longer create new admin-created custom apps. Existing apps are unaffected and continue to work. For new apps, use Dev Dashboard or Shopify CLI.

Admin-created custom apps are apps created directly in the Shopify admin, without going through the OAuth installation flow. Shopify pre-generates API access tokens when the merchant installs the app. There's no authorization code grant, no shopify.app.toml, and no managed installation.

If you're maintaining an existing admin-created custom app, use this page to reference how to authenticate API requests, understand the limitations around credential rotation, and manage API scopes.

Anchor to Make authenticated requestsMake authenticated requests

Your app's API access token is shown only once, when it's generated, so store it somewhere secure at that point. To see whether it's still available, go to Apps > Develop apps > [your app] > API credentials. If the token is no longer retrievable, generate a new one. Use the token to authenticate requests to the GraphQL Admin API.

The following examples query the GraphQL Admin API to retrieve the first five products from a store.

Info

The following examples require the SHOP_TOKEN environment variable set to your Admin API access token with at least the read_products scope. Replace {shop} with your store's subdomain.

cURL

curl -sX POST \
https://{shop}.myshopify.com/admin/api/2026-07/graphql.json \
-H 'Content-Type: application/json' \
-H "X-Shopify-Access-Token: ${SHOP_TOKEN}" \
-d @- <<EOF
{
"query": "{
products(first: 5) {
edges {
node {
id
handle
}
}
pageInfo {
hasNextPage
}
}
}"
}
EOF

You can pipe the response through jq to extract specific fields:

cURL with jq

curl -sX POST \
https://{shop}.myshopify.com/admin/api/2026-07/graphql.json \
-H 'Content-Type: application/json' \
-H "X-Shopify-Access-Token: ${SHOP_TOKEN}" \
-d @- <<EOF | jq '.data.products.edges[].node | {id, handle}'
{
"query": "{
products(first: 5) {
edges {
node {
id
handle
}
}
pageInfo {
hasNextPage
}
}
}"
}
EOF

Anchor to Rotate or generate new credentialsRotate or generate new credentials

You can't rotate the API key or secret for an admin-created custom app. To generate a new access token, uninstall and reinstall the app from the Shopify admin. The app itself stays intact: uninstalling removes it from the store, and reinstalling generates a new token. Your app's requests and webhooks are disrupted until you update your code with the new token.

Caution

Don't delete the app itself. Deleting removes the app configuration from the Shopify admin permanently, and you can't create a new admin-created custom app to replace it. If you need a new app, use Dev Dashboard to create one with a proper OAuth flow.

If you need to rotate access tokens for a custom storefront built with the Headless channel, see Rotate private access tokens.

Anchor to Change API scopesChange API scopes

Anyone with a staff or collaborator account on a store can change what resources an admin-created custom app can access, provided they have the Manage and install apps and channels permission, the Develop apps permission, and the relevant permissions for the resource being changed.

The store owner can change staff or collaborator permissions in the Shopify admin.

Anchor to Permissions required to assign scopesPermissions required to assign scopes

The following table shows what store permissions a staff or collaborator account needs to assign Admin API access scopes to an admin-created custom app. The account must also have the Develop apps permission in all cases.

Admin API scope namePermissions required
read_analyticsView store metrics
read_assigned_fulfillment_orders, write_assigned_fulfillment_ordersView or manage fulfillment orders
read_customer_merge, write_customer_mergeView or manage customer profile merges
read_customers, write_customersView or manage customers, customer addresses, order history, and customer groups
read_discounts, write_discountsView or manage automatic discounts and discount codes
read_draft_orders, write_draft_ordersView or manage orders created by app users on behalf of customers
read_files, write_filesView or manage files
read_fulfillments, write_fulfillmentsView or manage fulfillment services
read_gdpr_data_requestView GDPR data requests
read_gift_cards, write_gift_cardsView or manage gift cards (Shopify Plus only)
read_inventory, write_inventoryView or manage inventory across multiple locations
read_legal_policies, write_legal_policiesView or manage a shop's legal policies
read_locationsView the geographic location of stores, headquarters, and warehouses
read_marketing_events, write_marketing_eventsView or manage marketing events and engagement data
read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_ordersView or manage fulfillment orders assigned to merchant-managed locations
read_metaobject_definitions, write_metaobject_definitionsView or manage metaobject definitions
read_metaobjects, write_metaobjectsView or manage metaobject entries
read_online_store_navigationView menus for display on the storefront
read_online_store_pages, write_online_store_pagesView or manage Online Store pages
read_order_edits, write_order_editsView or manage edits to orders
read_orders, write_orders, read_all_ordersView or manage orders, transactions, fulfillments, and abandoned checkouts from the last 60 days, or view all past and future orders
read_price_rules, write_price_rulesView or manage conditional discounts
read_products, write_productsView or manage products, variants, and collections
read_product_listings, write_product_listingsView or manage product or collection listings
read_reports, write_reportsView or manage reports on the Reports page in the Shopify admin
read_resource_feedbacks, write_resource_feedbacksView or manage the status of shops and resources
read_script_tags, write_script_tagsView or manage JavaScript code in storefront or order status pages
read_shipping, write_shippingView or manage shipping carriers, countries, and provinces
read_shopify_payments_accountsView Shopify Payments accounts
read_shopify_payments_bank_accountsView bank accounts that can receive Shopify Payments payouts
read_shopify_payments_disputesView Shopify Payments disputes raised by buyers
read_shopify_payments_payoutsView Shopify Payments payouts and the account's current balance
read_content, write_contentView or manage articles, blogs, comments, pages, and redirects
read_themes, write_themesView or manage theme templates and assets
read_third_party_fulfillment_orders, write_third_party_fulfillment_ordersView or manage fulfillment orders assigned to a location managed by any fulfillment service
read_translations, write_translationsView or manage content that can be translated

Anchor to Next stepsNext steps

Was this page helpful?