Open OAuth tools

Commerce

Shopify OAuth

Exchange Shopify app credentials for an Admin API token, then verify the token against the shop.

Built-in workflowShopify authentication docs Workflow guide

Domain finder

Find the .myshopify.com address

You need to use the original .myshopify.com domain; custom domains are rejected.

Credentials

Admin token exchange

82 resources
  • Products, variants, and collectionsCommonread_products · write_products
  • Orders, transactions, and abandoned checkouts (last 60 days)Commonread_orders · write_orders
  • CustomersCommonread_customers · write_customers
  • Inventory items and levelsCommonread_inventory · write_inventory
  • Draft ordersCommonread_draft_orders · write_draft_orders
  • DiscountsCommonread_discounts · write_discounts
  • Articles, blogs, comments, and pagesCommonread_content · write_content
  • Online store themesCommonread_themes · write_themes
  • All orders, beyond the last 60 daysApprovalread_all_orders
  • Analytics annotationsread_analytics_annotations · write_analytics_annotations
  • App proxywrite_app_proxy
  • Apps that created fulfillment holdsApprovalread_apps
  • Fulfillment orders assigned to your fulfillment serviceread_assigned_fulfillment_orders · write_assigned_fulfillment_orders
  • Fulfillment orders at merchant-managed locationsread_merchant_managed_fulfillment_orders · write_merchant_managed_fulfillment_orders
  • Fulfillment orders at any fulfillment serviceread_third_party_fulfillment_orders · write_third_party_fulfillment_orders
  • Marketplace fulfillment ordersApprovalread_marketplace_fulfillment_orders
  • Cart transformsread_cart_transforms · write_cart_transforms
  • POS cash trackingread_cash_tracking · write_cash_tracking
  • Checkout and accounts configurationsread_checkout_and_accounts_configurations · write_checkout_and_accounts_configurations
  • Checkout brandingread_checkout_branding_settings · write_checkout_branding_settings
  • Checkout settingsApprovalread_checkout_settings · write_checkout_settings
  • B2B companies, locations, and contactsread_companies · write_companies
  • Online store pagesread_online_store_pages · write_online_store_pages
  • Customer data erasure requestsread_customer_data_erasure · write_customer_data_erasure
  • Customer mergesread_customer_merge · write_customer_merge
  • Customer payment methodsApprovalread_customer_payment_methods
  • Delivery customizationsread_delivery_customizations · write_delivery_customizations
  • Delivery promisesApprovalread_delivery_promises · write_delivery_promises
  • Files, images, videos, and 3D modelsread_files · write_files
  • Financial KYC informationApprovalread_financial_kyc_information
  • Fulfillment constraint rulesread_fulfillment_constraint_rules · write_fulfillment_constraint_rules
  • Fulfillment servicesread_fulfillments · write_fulfillments
  • Gift card transactionsread_gift_card_transactions · write_gift_card_transactions
  • Gift cardsread_gift_cards · write_gift_cards
  • Inventory shipmentsread_inventory_shipments · write_inventory_shipments
  • Inventory shipment received itemsread_inventory_shipments_received_items · write_inventory_shipments_received_items
  • Inventory transfersread_inventory_transfers · write_inventory_transfers
  • Legal policiesread_legal_policies · write_legal_policies
  • Shop localesread_locales · write_locales
  • Locationsread_locations · write_locations
  • Marketing eventsread_marketing_events · write_marketing_events
  • Marketplace ordersApprovalread_marketplace_orders · write_marketplace_orders
  • Marketplace returnsApprovalread_marketplace_returns · write_marketplace_returns
  • Marketsread_markets · write_markets
  • Merchant approval signalsApprovalread_merchant_approval_signals
  • Metaobject definitionsread_metaobject_definitions · write_metaobject_definitions
  • Metaobjectsread_metaobjects · write_metaobjects
  • Mobile platform applicationsApprovalread_mobile_platform_applications · write_mobile_platform_applications
  • Navigation menus and URL redirectsread_online_store_navigation · write_online_store_navigation
  • Order editsread_order_edits · write_order_edits
  • Subscription contractsApprovalread_own_subscription_contracts · write_own_subscription_contracts
  • Payment customizationsread_payment_customizations · write_payment_customizations
  • Payment gatewaysApprovalread_payment_gateways · write_payment_gateways
  • Payment mandatesApprovalread_payment_mandate · write_payment_mandate
  • Payment sessionsApprovalread_payment_sessions · write_payment_sessions
  • Payment terms and schedulesread_payment_terms · write_payment_terms
  • Web and server pixelsread_pixels · write_pixels
  • Customer eventsread_customer_events
  • Price rulesread_price_rules · write_price_rules
  • Privacy and cookie banner settingsread_privacy_settings · write_privacy_settings
  • Product listingsread_product_listings
  • Publications and sales channelsread_publications · write_publications
  • Reportsread_reports · write_reports
  • Resource feedbackread_resource_feedbacks · write_resource_feedbacks
  • Returnsread_returns · write_returns
  • Rolloutsread_rollouts
  • Script tagsread_script_tags · write_script_tags
  • Shipping and carrier servicesread_shipping · write_shipping
  • Shopify PaymentsApprovalread_shopify_payments
  • Shopify Payments accountsread_shopify_payments_accounts
  • Shopify Payments account sensitive dataApprovalread_shopify_payments_accounts_sensitive
  • Shopify Payments bank accountsread_shopify_payments_bank_accounts
  • Shopify Payments dispute evidenceApprovalread_shopify_payments_dispute_evidences · write_shopify_payments_dispute_evidences
  • Shopify Payments dispute file uploadsApprovalread_shopify_payments_dispute_file_uploads · write_shopify_payments_dispute_file_uploads
  • Shopify Payments disputesread_shopify_payments_disputes
  • Shopify Payments payoutsread_shopify_payments_payouts
  • Store credit account transactionsread_store_credit_account_transactions · write_store_credit_account_transactions
  • Store credit accountsread_store_credit_accounts
  • TaxesApprovalread_taxes · write_taxes
  • Translationsread_translations · write_translations
  • Staff membersApprovalread_users
  • Validationsread_validations · write_validations
Write includes read, so picking Write replaces the matching Read. Shopify scope reference ↗

Nothing you enter here is saved. It stays in this page until you close it.

Workflow guide

How the Shopify workflow works

Back to the tool ↑
  1. 01Find domainLook up the .myshopify.com address if you only know the custom domain.
  2. 02PrepareChoose the grant type and enter the app's client ID, secret, and grant inputs.
  3. 03ExchangeSend the credentials to the shop's token endpoint.
  4. 04VerifyConfirm the shop's Admin API accepts the returned token.
  5. 05Next stepsCopy the token and store it safely outside anonymous mode.

What this workflow can do

  • Find the .myshopify.com domain
  • Exchange authorization code
  • Client credentials grant
  • Verify token against the shop
  • Refresh token

Before starting

  • Shop domain (your-store.myshopify.com)
  • Client ID and client secret from the Shopify app
  • Authorization code and redirect URI, for the authorization code grant
  • Scopes, for the client credentials grant (optional)
  • Admin API version to verify against

Result handling

  • The Admin API access token appears in the result panel and is verified against shop.json.
  • Scope, expiry, and shop name are shown with the token.
  • Anonymous OAuth Hub workflows do not store client secrets, authorization codes, or access tokens.

Provider warnings

  • Use the original .myshopify.com domain; custom domains are rejected.
  • Client credentials only work for stores in your own Shopify organization. Those tokens last 24 hours.

Troubleshooting

  • Use the store's original .myshopify.com domain, not a custom domain. The domain finder can look it up.
  • Install or reinstall the app after scope changes before requesting a new token.
  • Authorization codes are single-use. If an exchange fails, start a new install or authorization to get a fresh code.
  • Client credentials only work for stores in your own Shopify organization, and those tokens last 24 hours.

Provider checklist

  1. Confirm app is installed on the target .myshopify.com store.
  2. Verify Admin API scopes in Shopify app settings before token exchange.
  3. Exchange the credentials on this page, then check that verification against /shop.json passes.
  4. Store token in secure server-side secret manager (never frontend localStorage).