Shopify Access Token, How to Get Access Token on Shopify, Storefront Admin Api Easily 2026

Shopify split this task into two paths depending on when your custom app exists. If you already have one from before January 1, 2026, skip ahead to the next step for its API credentials tab.

If you're starting today, skip to the Dev Dashboard steps further down, because clicking Create an app from Develop apps no longer creates a new app. Shopify's own documentation says existing apps are unaffected and keep working, but new attempts are redirected.

From Develop apps, click into your existing custom app, then open API credentials. If the app is installed, the Admin API access token is right there.

Lost track of it, or need to invalidate one that leaked? Click Uninstall app, then Install app again; that issues a fresh token immediately and kills the old one. This path only applies to apps created before Shopify closed off new admin-created custom apps.

Older guides, including earlier versions of this one, describe clicking Create an app from Develop apps, naming the app, and confirming the developer account it's attached to, shown below. That dialog stopped creating new apps on January 1, 2026. Shopify's documentation is direct about it: you can no longer create new admin-created custom apps, though existing ones are unaffected and continue to work exactly as before.

Go to dev.shopify.com/dashboard, or follow the Build apps in Dev Dashboard link that now sits where Create an app used to. Select Create app, name it, and open its Versions tab to choose the Admin API access scopes it needs; the same principle as before applies, check only what your integration will use.

Select Release once the scopes are set, then install the app to a store from its Home tab. The app and the store need to belong to the same Shopify organization, which every store already has.

A Dev Dashboard app doesn't hand you a static token to copy. Under Settings, it shows a Client ID and a Client secret instead.

To turn those into something the Admin API accepts, send a POST request to https://{shop}.myshopify.com/admin/oauth/access_token with grant_type set to client_credentials, plus your client_id and client_secret. Shopify returns an access_token good for 24 hours (expires_in: 86399 seconds). There's no copy-paste step here: whatever calls the Admin API also has to request a new token before the old one expires.

A pre-2026 custom app still shows Storefront API scopes as checkboxes grouped by resource, prefixed unauthenticated_ since storefront requests aren't tied to a staff login, shown below. For anything built today, that screen isn't where a Storefront token comes from.

Install the Headless channel from the Shopify App Store instead, then click Create storefront; it generates a public and a private Storefront API access token in one step. Go to Sales channels, then Headless, then Add storefront, for any additional ones you need.

Treat a Client secret, or a legacy Access Token, like a password: never commit it to a public repository, never paste it into a support ticket screenshot, and store it in environment variables or a secrets manager instead of hardcoding it into a script. If one is ever exposed, rotate it immediately: regenerate the Client secret in Dev Dashboard Settings, or uninstall and reinstall a legacy app. Either action invalidates whatever was issued before it.