Shopify Access Token, How to Get Access Token on Shopify, Storefront Admin Api Easily 2026

From your Shopify admin's Settings menu, click Apps and sales channels. This page lists every app currently installed on your store — things like Online Store, Point of Sale, Buy Button, and any sales channels or third-party apps you've added — split into Installed and Uninstalled tabs. In the top-right corner sit two buttons: Shopify App Store, for browsing apps built by others, and Develop apps, which is the one you actually need to build your own custom app and issue an Access Token.

Click Develop apps, then Create an app. A dialog opens asking for an App name and confirming the App developer account it's attached to — name it something that describes what it's actually for, since you may end up with several custom apps over time and a vague name gets confusing fast.

Shopify notes that the app is only assignable to staff and collaborators with development permissions, and that it's subject to the Shopify API License and Terms of Use. Click Create app to continue.

Once the app exists, you'll configure two separate sets of permissions: Admin API scopes control access to store management data like orders, products, and customers, while Storefront API scopes control what a public-facing storefront experience — a custom frontend, a mobile app, an in-game store — is allowed to read or write on behalf of a shopper. These are genuinely different credentials for different jobs, which is the single most common source of confusion people run into with Shopify tokens.

On the scopes screen, permissions are grouped by resource — selling plans, bulk operations, bundles, Shop Pay installments pricing, and many more — each with its own checkbox for read or write access, prefixed unauthenticated_ for Storefront API scopes since storefront requests aren't tied to a logged-in staff account. Only check the scopes your specific integration or script will use. A calculator tool that just reads selling plans, for example, needs nothing beyond that — leaving bulk operations, bundles, and everything else unchecked keeps the resulting token as narrow as possible.

After saving your scopes, install the app on your store from the API credentials tab. Installing is what actually activates the app and makes its Access Token available — Shopify reveals the token once at that point, so copy it immediately into a password manager or secrets store rather than a plain text file or chat message, since you generally can't view the full token again after leaving the page.

If a request comes back with this error, the most common causes are: the app was created but never installed (uninstalled apps don't have an active token), the token was regenerated after the one your integration is using, the request is hitting the wrong endpoint for the token type (using an Admin token against a Storefront API URL or vice versa), or a scope needed for that specific request was never checked. Re-check the API credentials tab for the current token and confirm the scope you need is enabled before assuming the integration code itself is broken.

Treat an Access Token like a password: never commit it to a public repository, never share it in a support ticket screenshot, and store it in environment variables or a secrets manager rather than hardcoding it into a script. If a token is ever exposed, go back into the app's API credentials tab and revoke or regenerate it immediately — the old one stops working the moment a new one is issued, which limits the damage of a leak to whatever happened before you caught it.