--- title: Manage service accounts description: >- Learn how to create service accounts so Shopify CLI can deploy your app and manage dev stores from CI/CD pipelines, scripts, and agents. source_url: html: 'https://shopify.dev/docs/apps/build/cli-for-apps/service-accounts' md: 'https://shopify.dev/docs/apps/build/cli-for-apps/service-accounts.md' --- # Manage service accounts A service account is an identity that your organization owns, built for automation. Use a service account token to run Shopify CLI where no one can log in through a browser, such as CI/CD pipelines, scripts, and AI agents. A service account can have one or both of the following permissions: * **App development**: Use Shopify CLI to deploy and manage one existing app, with commands such as [`app deploy`](https://shopify.dev/docs/api/shopify-cli/app/app-deploy). * **Dev store management**: Add, view, and delete [dev stores](https://shopify.dev/docs/apps/build/stores/development-stores) in your organization. You choose a service account's permissions when you create it, and you can't change them later. To use different permissions, create another service account. The service account belongs to the organization, not to the person who created it. Its tokens keep working if that person leaves the organization or loses their own permissions. **Info:** To authenticate your app's requests to Shopify APIs, refer to [Authentication and authorization](https://shopify.dev/docs/apps/build/authentication-authorization). *** ## Requirements * You have permission to build and manage apps in your organization, for example through the **App developer** role. You need this permission for every service account, including one that only manages dev stores. * To create a service account with the **Dev store management** permission, or to generate a token for one, you also need permission to create and manage dev stores across your whole organization. * You're using Shopify CLI version 5.0.0 or higher. To learn which roles include these permissions, refer to [User permissions](https://shopify.dev/docs/apps/build/dev-dashboard/user-permissions). *** ## How service accounts and tokens work Each service account can have up to two active tokens. Both tokens have the same permissions, and each one has its own expiration date. Two tokens let you [rotate a token](#rotate-a-token) without downtime. Revoking a token or letting it expire affects only that token. The service account, its permissions, its other token, and the stores that it owns all remain in place. A service account with no active tokens is still valid, and you can generate a new token for it at any time. *** ## Find your service accounts Service accounts are listed in the **Organization service accounts** section of your organization's **Security** settings: * In the Shopify admin, go to **Settings** > **Users** > **Security**. * In the [Dev Dashboard](https://dev.shopify.com/dashboard/), open your app, go to **Settings**, and then click **Manage** in the **App CLI automation token** section. To open a service account, click its name in the list. *** ## Create a service account 1. [Find your service accounts](#find-your-service-accounts), and then click **Add service account**. 2. Enter a name that describes what the service account is for, such as `Release automation`. 3. In the **Access token** section, select when the first token expires: 1, 3, or 6 months. 4. In the **Permissions** section, select one or both permissions: * Select **App development**, and then choose the app that the service account can deploy and manage. * Select **Dev store management**. 5. Click **Add service account**. 6. On the service account's page, copy the new token. 7. Store the token as a secret in your CI/CD provider, or mask it wherever you use it. **Caution:** You can see a token only right after it's generated. If you lose it, then generate a new one and revoke the lost one. *** ## Use a service account token with Shopify CLI Set the token as the `SHOPIFY_SERVICE_ACCOUNT_TOKEN` environment variable. Shopify CLI uses it to authenticate without a browser login or prompts. The following examples deploy an app, and create and delete a dev store: ##### Deploy an app ```bash export SHOPIFY_SERVICE_ACCOUNT_TOKEN=your-token-value shopify app deploy --config production --allow-updates ``` ##### Create and delete a dev store ```bash export SHOPIFY_SERVICE_ACCOUNT_TOKEN=your-token-value # Find your organization ID shopify organization list shopify store create dev --name "E2E test store" --organization-id 1234567 --plan basic --json shopify store delete --store your-dev-store.myshopify.com --organization-id 1234567 --force ``` **Info:** Don't set `SHOPIFY_APP_AUTOMATION_TOKEN` or `SHOPIFY_CLI_PARTNERS_TOKEN` at the same time as `SHOPIFY_SERVICE_ACCOUNT_TOKEN`, or the command fails. While `SHOPIFY_SERVICE_ACCOUNT_TOKEN` is set, commands that need your own Shopify login, such as [`store auth`](https://shopify.dev/docs/api/shopify-cli/store/store-auth) and [`store execute`](https://shopify.dev/docs/api/shopify-cli/store/store-execute), don't run. For full CI/CD setup with GitHub Actions and CircleCI, refer to [Deploy app components in a CI/CD pipeline](https://shopify.dev/docs/apps/launch/deployment/deploy-in-ci-cd-pipeline). ### Supported commands | Permission | Commands | | - | - | | Either permission | [`organization list`](https://shopify.dev/docs/api/shopify-cli/general-commands/organization-list), which returns the service account's organization. | | **App development** | The same app commands that App Automation Tokens supported, such as [`app deploy`](https://shopify.dev/docs/api/shopify-cli/app/app-deploy) and [`app release`](https://shopify.dev/docs/api/shopify-cli/app/app-release), for the service account's app. | | **Dev store management** | [`store list`](https://shopify.dev/docs/api/shopify-cli/store/store-list), [`store create dev`](https://shopify.dev/docs/api/shopify-cli/store/store-create-dev), [`store info`](https://shopify.dev/docs/api/shopify-cli/store/store-info), and [`store delete`](https://shopify.dev/docs/api/shopify-cli/store/store-delete). | The **Dev store management** permission covers every dev store in your organization, including stores that other people or other service accounts created. It doesn't cover production stores, client transfer stores, collaborator stores, or stores in other organizations. In a non-interactive environment, pass `--organization-id` to `store list` and `store create dev`. The service account's token works only in its own organization. *** ## Stores created by a service account When a service account creates a dev store, the service account owns the store. The store appears in your organization's store list with the service account as its owner. People in your organization open the store with their usual permissions. The store stays in place when the service account's tokens expire or are revoked. Your organization's usual dev store creation limits still apply. *** ## Rotate a token Rotate a token before it expires so that your pipelines keep working. 1. Open the service account. 2. In the **Access token** section, click **Rotate** next to the token. 3. Select when the new token expires, and then click **Generate new token**. 4. Copy the new token. 5. Update your CI/CD secrets to use the new token. 6. After your pipelines are working with the new token, click **Revoke** next to the old token. Both tokens work until they expire or you revoke them. Generating a new token doesn't change the old token's expiration date. If the service account already has two active tokens, then revoke one before you rotate. *** ## Revoke a token 1. Open the service account. 2. In the **Access token** section, click **Revoke** next to the token. 3. Click **Revoke token**. Scripts and CI jobs that use the revoked token lose access. Revoking a token doesn't affect the service account, its other token, its permissions, or its stores. If a service account has no tokens, then click **Generate token** to create one. *** ## Delete a service account Deleting a service account revokes all of its tokens. The dev stores that the service account owns are transferred to your organization's owner. Deleting a service account never deletes its stores or its app. 1. Open the service account. 2. Click **Delete service account**. 3. Review how many dev stores will be transferred to the organization owner, and then click **Delete service account**. If the service account owns dev stores, then your organization's owner must be active to receive them. Deletion can take a moment to finish. Until it does, the service account shows **Deletion in progress**. If the deletion needs attention, then click **Check deletion status**. You can't delete a service account that was migrated from an App Automation Token. To stop one from working, [revoke all of its active tokens](#revoke-a-token) instead. After a rotation, it can have two. *** ## Migrate from App Automation Tokens Your existing App Automation Tokens are now service accounts. You don't need to change anything to keep them working: * Each token keeps its value, its expiration date, and its app. * Each token becomes its own service account with the **App development** permission for that app. It doesn't get the **Dev store management** permission. * In the service account list, each one is named **App automation token ending in** followed by the last six characters of its token. * Shopify CLI still accepts the token in `SHOPIFY_APP_AUTOMATION_TOKEN`, but that variable is deprecated. Shopify CLI shows a warning about it at most once a day. To use the new variable name, set the same token value as `SHOPIFY_SERVICE_ACCOUNT_TOKEN` and remove `SHOPIFY_APP_AUTOMATION_TOKEN`. Don't set both. To automate dev stores, [create a new service account](#create-a-service-account) with the **Dev store management** permission. You can rotate and revoke a migrated service account's tokens like any other, but you can't delete the service account. To stop it from working, revoke all of its active tokens. *** ## Migrate from Partner Dashboard tokens Partner Dashboard tokens, listed under **CLI tokens** in the Partner Dashboard, use the `SHOPIFY_CLI_PARTNERS_TOKEN` environment variable. They continue to work until they expire, but you can't create new ones. All remaining Partner Dashboard tokens expire by February 6, 2027, and some expire sooner. The variable is deprecated, and Shopify CLI shows a warning about it at most once a day. A Partner Dashboard token could access several apps. A service account can deploy and manage only one app, and it can't create apps. To migrate: 1. [Create a service account](#create-a-service-account) for each app that you deploy. 2. In each pipeline, replace `SHOPIFY_CLI_PARTNERS_TOKEN` with `SHOPIFY_SERVICE_ACCOUNT_TOKEN`, using the new service account's token. 3. After the new tokens are working, revoke your Partner Dashboard tokens. In the Partner Dashboard, click **CLI tokens**, or go to [CLI tokens](https://partners.shopify.com/current/settings/cli_tokens) directly. *** ## Limitations * A service account can deploy and manage one app at most. To automate several apps, create one service account for each app. * A service account can't create apps, run [`app dev`](https://shopify.dev/docs/api/shopify-cli/app/app-dev), install apps, or use the Partner API. * A service account token can't read or change a store's data. To work with a store's data, use [`store auth`](https://shopify.dev/docs/api/shopify-cli/store/store-auth) or an [app](https://shopify.dev/docs/apps/build/authentication-authorization). *** ## Next steps * [Deploy app components in a CI/CD pipeline](https://shopify.dev/docs/apps/launch/deployment/deploy-in-ci-cd-pipeline) with your service account token. * Learn about [dev stores](https://shopify.dev/docs/apps/build/stores/development-stores). * Review the [`store create dev`](https://shopify.dev/docs/api/shopify-cli/store/store-create-dev) command and its flags. ***