--- title: Generate access tokens for custom apps in the Shopify admin description: Authenticate a custom app that was created in the Shopify admin. source_url: html: https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin md: https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin.md --- ExpandOn this page * [Requirements](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#requirements) * [Step 1: Create and install the app](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#step-1-create-and-install-the-app) * [Step 2: Make authenticated requests](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#step-2-make-authenticated-requests) * [Rotating API credentials or generating new access tokens for admin-created apps](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#rotating-api-credentials-or-generating-new-access-tokens-for-admin-created-apps) * [Changing API scopes](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#changing-api-scopes) * [Next steps](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#next-steps) # Generate access tokens for custom apps in the Shopify admin You can create a custom app for a store directly in the Shopify admin. To authenticate an admin-created custom app, you or the app user needs to install the app from the Shopify admin to generate API credentials and the necessary API access tokens. Note This guide applies only to custom apps that were created in the Shopify admin. If you created a custom storefront with the Headless channel in the Shopify admin, then Shopify creates public and private access tokens for you. For more information, refer to [Getting started with the Storefront API](https://shopify.dev/docs/storefronts/headless/building-with-the-storefront-api/getting-started). If you created a custom app via the Dev Dashboard or with Shopify CLI, refer to [About token acquisition](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/). *** ## Requirements * You or the app user you're working with has created a Shopify store. * If you have a staff or collaborator account on a user's store, then make sure that the user gives you the [relevant permissions](#changing-api-scopes) to create a custom app and assign API scopes. * The different [ways that you can distribute your app](https://shopify.dev/docs/apps/launch/distribution/select-distribution-method). * You're familiar with the [different methods of authenticating and authorizing apps](https://shopify.dev/docs/apps/build/authentication-authorization) with Shopify's platform. *** ## Step 1: Create and install the app You or the user can create and install a custom app in the Shopify admin by following the [Custom apps documentation](https://help.shopify.com/manual/apps/custom-apps) on the Shopify Help Center. *** ## Step 2: Make authenticated requests A custom app can make authenticated requests to the GraphQL Admin API using the API access tokens that are generated when the app is installed on the store. The following example shows how to retrieve a list of products using the [GraphQL Admin API](https://shopify.dev/docs/api/admin-graphql): Info Running the following queries required exported `SHOP_TOKEN` Admin API access token with at least the `read_products` scope. If following along, replace `shop` with the subdomain of your Shopify store. If you need to add the `read_products` scope to your token, you may need to redeploy the app. ## cURL ```terminal curl -sX POST \ https://{shop}.myshopify.com/admin/api/2025-10/graphql.json \ -H 'Content-Type: application/json' \ -H "X-Shopify-Access-Token: ${SHOP_TOKEN}" \ -d @- <