Manage service accounts

A service account is an identity that your organization owns, built for automation. Use a service account token to run Shopify CLI where no one can log in through a browser, such as CI/CD pipelines, scripts, and AI agents.

A service account can have one or both of the following permissions:

• App development: Use Shopify CLI to deploy and manage one existing app, with commands such as app deploy.
• Dev store management: Add, view, and delete dev stores in your organization.

You choose a service account's permissions when you create it, and you can't change them later. To use different permissions, create another service account.

The service account belongs to the organization, not to the person who created it. Its tokens keep working if that person leaves the organization or loses their own permissions.

Anchor to RequirementsRequirements

• You have permission to build and manage apps in your organization, for example through the App developer role. You need this permission for every service account, including one that only manages dev stores.
• To create a service account with the Dev store management permission, or to generate a token for one, you also need permission to create and manage dev stores across your whole organization.
• You're using Shopify CLI version 5.0.0 or higher.

To learn which roles include these permissions, refer to User permissions.

Anchor to How service accounts and tokens workHow service accounts and tokens work

Each service account can have up to two active tokens. Both tokens have the same permissions, and each one has its own expiration date. Two tokens let you rotate a token without downtime.

Revoking a token or letting it expire affects only that token. The service account, its permissions, its other token, and the stores that it owns all remain in place. A service account with no active tokens is still valid, and you can generate a new token for it at any time.

Anchor to Find your service accountsFind your service accounts

Service accounts are listed in the Organization service accounts section of your organization's Security settings:

• In the Shopify admin, go to Settings > Users > Security.
• In the Dev Dashboard, open your app, go to Settings, and then click Manage in the App CLI automation token section.

To open a service account, click its name in the list.

Anchor to Create a service accountCreate a service account

1. Find your service accounts, and then click Add service account.
2. Enter a name that describes what the service account is for, such as Release automation.
3. In the Access token section, select when the first token expires: 1, 3, or 6 months.
4. In the Permissions section, select one or both permissions:
   • Select App development, and then choose the app that the service account can deploy and manage.
   • Select Dev store management.
5. Click Add service account.
6. On the service account's page, copy the new token.
7. Store the token as a secret in your CI/CD provider, or mask it wherever you use it.

Anchor to Use a service account token with Shopify CLIUse a service account token with Shopify CLI

Set the token as the SHOPIFY_SERVICE_ACCOUNT_TOKEN environment variable. Shopify CLI uses it to authenticate without a browser login or prompts. The following examples deploy an app, and create and delete a dev store:

export SHOPIFY_SERVICE_ACCOUNT_TOKEN=your-token-value
shopify app deploy --config production --allow-updates

export SHOPIFY_SERVICE_ACCOUNT_TOKEN=your-token-value

# Find your organization ID
shopify organization list

shopify store create dev --name "E2E test store" --organization-id 1234567 --plan basic --json
shopify store delete --store your-dev-store.myshopify.com --organization-id 1234567 --force

For full CI/CD setup with GitHub Actions and CircleCI, refer to Deploy app components in a CI/CD pipeline.

Anchor to Supported commandsSupported commands

The Dev store management permission covers every dev store in your organization, including stores that other people or other service accounts created. It doesn't cover production stores, client transfer stores, collaborator stores, or stores in other organizations.

In a non-interactive environment, pass --organization-id to store list and store create dev. The service account's token works only in its own organization.

Anchor to Stores created by a service accountStores created by a service account

When a service account creates a dev store, the service account owns the store. The store appears in your organization's store list with the service account as its owner. People in your organization open the store with their usual permissions.

The store stays in place when the service account's tokens expire or are revoked. Your organization's usual dev store creation limits still apply.

Anchor to Rotate a tokenRotate a token

Rotate a token before it expires so that your pipelines keep working.

1. Open the service account.
2. In the Access token section, click Rotate next to the token.
3. Select when the new token expires, and then click Generate new token.
4. Copy the new token.
5. Update your CI/CD secrets to use the new token.
6. After your pipelines are working with the new token, click Revoke next to the old token.

Both tokens work until they expire or you revoke them. Generating a new token doesn't change the old token's expiration date. If the service account already has two active tokens, then revoke one before you rotate.

Anchor to Revoke a tokenRevoke a token

1. Open the service account.
2. In the Access token section, click Revoke next to the token.
3. Click Revoke token.

Scripts and CI jobs that use the revoked token lose access. Revoking a token doesn't affect the service account, its other token, its permissions, or its stores.

If a service account has no tokens, then click Generate token to create one.

Anchor to Delete a service accountDelete a service account

Deleting a service account revokes all of its tokens. The dev stores that the service account owns are transferred to your organization's owner. Deleting a service account never deletes its stores or its app.

1. Open the service account.
2. Click Delete service account.
3. Review how many dev stores will be transferred to the organization owner, and then click Delete service account.

If the service account owns dev stores, then your organization's owner must be active to receive them.

Deletion can take a moment to finish. Until it does, the service account shows Deletion in progress. If the deletion needs attention, then click Check deletion status.

You can't delete a service account that was migrated from an App Automation Token. To stop one from working, revoke all of its active tokens instead. After a rotation, it can have two.

Anchor to Migrate from App Automation TokensMigrate from App Automation Tokens

Your existing App Automation Tokens are now service accounts. You don't need to change anything to keep them working:

• Each token keeps its value, its expiration date, and its app.
• Each token becomes its own service account with the App development permission for that app. It doesn't get the Dev store management permission.
• In the service account list, each one is named App automation token ending in followed by the last six characters of its token.
• Shopify CLI still accepts the token in SHOPIFY_APP_AUTOMATION_TOKEN, but that variable is deprecated. Shopify CLI shows a warning about it at most once a day.

To use the new variable name, set the same token value as SHOPIFY_SERVICE_ACCOUNT_TOKEN and remove SHOPIFY_APP_AUTOMATION_TOKEN. Don't set both.

To automate dev stores, create a new service account with the Dev store management permission.

You can rotate and revoke a migrated service account's tokens like any other, but you can't delete the service account. To stop it from working, revoke all of its active tokens.

Anchor to Migrate from Partner Dashboard tokensMigrate from Partner Dashboard tokens

Partner Dashboard tokens, listed under CLI tokens in the Partner Dashboard, use the SHOPIFY_CLI_PARTNERS_TOKEN environment variable. They continue to work until they expire, but you can't create new ones. All remaining Partner Dashboard tokens expire by February 6, 2027, and some expire sooner. The variable is deprecated, and Shopify CLI shows a warning about it at most once a day.

A Partner Dashboard token could access several apps. A service account can deploy and manage only one app, and it can't create apps. To migrate:

1. Create a service account for each app that you deploy.
2. In each pipeline, replace SHOPIFY_CLI_PARTNERS_TOKEN with SHOPIFY_SERVICE_ACCOUNT_TOKEN, using the new service account's token.
3. After the new tokens are working, revoke your Partner Dashboard tokens. In the Partner Dashboard, click CLI tokens, or go to CLI tokens directly.

Anchor to LimitationsLimitations

• A service account can deploy and manage one app at most. To automate several apps, create one service account for each app.
• A service account can't create apps, run app dev, install apps, or use the Partner API.
• A service account token can't read or change a store's data. To work with a store's data, use store auth or an app.

Anchor to Next stepsNext steps

• Deploy app components in a CI/CD pipeline with your service account token.
• Learn about dev stores.
• Review the store create dev command and its flags.