Shopify

Overview

Use a Shopify Admin API access token to make authenticated Admin API calls through Alter Vault without exposing the token in code.

Property	Value
Provider ID	shopify
Category	E-commerce
Credential Type	API Key

Note

This template stores an Admin API access token (shpat_...) you already hold. Since January 1, 2026 the Shopify admin no longer creates custom apps, so a new token only comes from a custom app created in the admin before that date. An app created in the Shopify Dev Dashboard never shows a token: use Shopify (Dev Dashboard app) for those, and Alter mints the token from the app’s Client ID and Client secret.

Step 1: Get Credentials

Open the custom app in the Shopify admin

In the Shopify admin go to Settings > Apps and sales channels > Develop apps and open the existing custom app. Shopify’s legacy custom app guide covers these apps.

Copy the Admin API access token

On the API credentials tab, copy the Admin API access token (starts with shpat_). It is shown once, at install time; if it was not saved, uninstall and reinstall the app to get a new one.

Note the store subdomain

Note the store subdomain (for example your-store from your-store.myshopify.com).

Note

Any Admin API access token works here, including an offline token obtained through Shopify’s authorization-code install flow; Alter does not run that flow, so the token must already exist. Admin-created custom apps cannot have their credentials rotated: to get a new token, uninstall and reinstall the app. Never delete the app: deletion is permanent, and since January 1, 2026 a replacement admin-created custom app can no longer be created. The customers/* operations and customer fields on orders/* require Shopify’s protected customer data approval (Dev Dashboard: API access > Protected customer data); without it those endpoints return 403. products/* and shop/get need no approval.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Shopify

Go to Managed Secrets > Add Provider > Shopify.

Enter credentials

Paste your Admin API Access Token into the credential field, and enter your store subdomain (e.g. your-store) in the Store Subdomain field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://your-store.myshopify.com/admin/api/YOUR_API_VERSION/products.json",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
orders/cancel	admin, delete, payment	POST	/admin/api/{api_version}/orders/{order_id}/cancel.json
orders/create	admin, payment	POST	/admin/api/{api_version}/orders.json
customers/create	admin, write	POST	/admin/api/{api_version}/customers.json
graphql	admin, delete, payment, read, send, write	POST	/admin/api/{api_version}/graphql.json
products/create	admin, write	POST	/admin/api/{api_version}/products.json
webhooks/create	admin, write	POST	/admin/api/{api_version}/webhooks.json
customers/list	read	GET	/admin/api/{api_version}/customers.json
customers/search	read	GET	/admin/api/{api_version}/customers/search.json
inventory_levels/list	read	GET	/admin/api/{api_version}/inventory_levels.json
orders/list	read	GET	/admin/api/{api_version}/orders.json
products/count	read	GET	/admin/api/{api_version}/products/count.json
products/list	read	GET	/admin/api/{api_version}/products.json
shop/get	read	GET	/admin/api/{api_version}/shop.json
variants/list	read	GET	/admin/api/{api_version}/products/{product_id}/variants.json
webhooks/list	read	GET	/admin/api/{api_version}/webhooks.json