Shopify (Dev Dashboard app)

Overview

Use the Client ID and Client secret of a Shopify app created in the Dev Dashboard to make authenticated Admin API calls through Alter Vault. The client secret stays in the vault: Alter exchanges it for a short-lived Admin API access token through Shopify’s client-credentials grant and only that token is sent on the wire and returned to the SDK.

Property	Value
Provider ID	shopify-client-credentials
Category	E-commerce
Credential Type	OAuth client credentials

Note

This provider reaches the same Admin API as Shopify, which stores an Admin API access token you already hold. Apps created in the Dev Dashboard never show a token, so this is the template for them; the legacy template remains for custom apps created in the Shopify admin before January 1, 2026.

Step 1: Get Credentials

Create the app in the Dev Dashboard

Open the Shopify Dev Dashboard, select the organization that owns the store, and on Apps click Create app > Start from Dev Dashboard. Name the app and click Create. Shopify’s Dev Dashboard guide covers the full flow.

Release a version with the scopes

On the app’s Versions tab, create a new version, enter the Admin API scopes the integration needs, then click Release.

Install the app on the store

Back on the app’s Home page click Install app, pick the store, and confirm. The store must belong to the same Dev Dashboard organization as the app.

Copy the credentials

Go to the app’s Settings and copy the Client ID and the Client secret under Credentials.

Note

The exchange only works when the app and the store are in the same Dev Dashboard organization; for a store in another organization Shopify answers shop_not_permitted, and the save reports that the exchange could not be completed. See Shopify’s client credentials grant reference. The customers/* operations and customer fields on orders/* require Shopify’s protected customer data approval (Dev Dashboard: API access > Protected customer data); without it those endpoints return 403. products/* and shop/get need no approval.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Shopify (Dev Dashboard app)

Go to Managed Secrets > Add Provider > Shopify (Dev Dashboard app).

Enter credentials

Enter your store subdomain (e.g. your-store from your-store.myshopify.com) and the Client ID in their fields, and paste the Client secret into the credential field.

Save

Click Save. Alter performs a real token exchange to verify the credentials before storing them. You’ll receive a grant_id to use with the SDK.

Note

Alter caches the minted token for up to an hour and sends it in X-Shopify-Access-Token; the client secret never leaves the backend. The token’s scopes are whatever the released app version declares: to change them, release a new version and approve the change on the store, and an already-cached token picks the new scopes up within the hour. Rotating the Client secret in the Dev Dashboard keeps the old secret active until you revoke it, so update the stored secret in Alter before revoking the old one. The SDK token channel returns only the minted token and its injection header, never the store subdomain or Client ID, so keep the store host in the application’s own configuration.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://your-store.myshopify.com/admin/api/YOUR_API_VERSION/products.json",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
orders/cancel	admin, delete, payment	POST	/admin/api/{api_version}/orders/{order_id}/cancel.json
orders/create	admin, payment	POST	/admin/api/{api_version}/orders.json
customers/create	admin, write	POST	/admin/api/{api_version}/customers.json
graphql	admin, delete, payment, read, send, write	POST	/admin/api/{api_version}/graphql.json
products/create	admin, write	POST	/admin/api/{api_version}/products.json
webhooks/create	admin, write	POST	/admin/api/{api_version}/webhooks.json
customers/list	read	GET	/admin/api/{api_version}/customers.json
customers/search	read	GET	/admin/api/{api_version}/customers/search.json
inventory_levels/list	read	GET	/admin/api/{api_version}/inventory_levels.json
orders/list	read	GET	/admin/api/{api_version}/orders.json
products/count	read	GET	/admin/api/{api_version}/products/count.json
products/list	read	GET	/admin/api/{api_version}/products.json
shop/get	read	GET	/admin/api/{api_version}/shop.json
variants/list	read	GET	/admin/api/{api_version}/products/{product_id}/variants.json
webhooks/list	read	GET	/admin/api/{api_version}/webhooks.json