How to Get a Shopify Admin API Access Token in 2026: Step-by-Step Guide

If you need to connect your Shopify store to a custom application, automation platform, inventory system, ERP, or another external tool, you’ll usually need access to the Shopify Admin API.

The first challenge is authentication.

Shopify’s process for generating an Admin API access token changed significantly in 2026, which means many older tutorials no longer match what merchants see inside Shopify.

This guide explains how to get a Shopify Admin API Access Token using the current Shopify Dev Dashboard and Postman, without requiring programming knowledge.

Important Shopify API Change in 2026

Older Shopify tutorials usually tell you to:

1. Go to Settings → Apps and sales channels → Develop apps.
2. Create a custom app.
3. Configure Admin API scopes.
4. Install the app.
5. Copy a permanent token beginning with shpat_.

That workflow is now outdated for newly created apps.

New apps are created through Shopify’s Dev Dashboard, and Shopify no longer simply displays an Admin API token after installation. For server-side integrations connecting to stores within your own Shopify organization, Shopify now supports the client credentials grant.

Instead of manually copying a permanent token, you exchange your:

• Client ID
• Client Secret

for an access token.

Shopify states that access tokens generated through the client credentials grant are valid for approximately 24 hours (86399 seconds) and can be requested again when needed.

---

What Is a Shopify Admin API Access Token?

A Shopify Admin API Access Token is a secure credential that allows an application or integration to make authenticated requests to your Shopify store.

The permissions attached to the token depend on the Admin API scopes you assign to your app.

For example, an integration could be allowed to:

• Read Shopify products
• Create or update products
• Read inventory
• Update inventory quantities
• Access orders
• Manage customers
• Work with metafields
• Connect Shopify with an ERP or CRM

Shopify’s GraphQL Admin API expects the access token in the X-Shopify-Access-Token request header.

Shopify Client ID vs Client Secret vs Access Token

These three credentials serve different purposes.

Credential	Purpose
Client ID	Identifies your Shopify app
Client Secret	Proves that your application is authorized to authenticate
Access Token	Authenticates actual Shopify Admin API requests

Your Client Secret and Access Token should always be kept private.

---

What You’ll Need Before Starting

Before generating your Shopify Admin API access token, make sure you have:

• Admin or appropriate app-development access to your Shopify store
• Access to the Shopify Dev Dashboard
• Postman installed on your computer
• Approximately 10–15 minutes

You can download Postman from its official website.

No programming knowledge is required for the process below.

---

Step 1: Create an App in the Shopify Dev Dashboard

Shopify now uses the Dev Dashboard for creating new apps.

1. Sign in to Shopify.
2. Open the Shopify Dev Dashboard.
3. Select Apps from the left-hand menu.
4. Click Create app.
5. Select Start from Dev Dashboard.
6. Enter a recognizable name for the app.

For example:

MyStore Integration

or:

MyStore API App

7. Click Create.

Shopify’s current documentation confirms that apps created through the Dev Dashboard must have an app version configured before they can be installed.

---

Step 2: Configure Your Shopify App

After creating the app, open the Versions section.

You’ll now configure how the app can interact with your Shopify store.

Set the App URL

If your integration doesn’t have its own application interface, Shopify allows non-embedded apps to use its default app-home URL.

You do not need to use a fake localhost callback simply to generate a client-credentials token.

Choose Admin API Scopes

Next, choose the permissions your integration actually needs.

For a system that manages products and inventory, common permissions include:

• Products — Read
• Products — Write
• Inventory — Read
• Inventory — Write

Depending on your integration, additional scopes might be required.

Follow the Principle of Least Privilege

Don’t enable every available Shopify permission simply because you can.

Only give your application access to information it genuinely requires.

For example, an inventory synchronization tool shouldn’t receive customer or order permissions unless those resources are necessary for its functionality.

Shopify uses access scopes to determine exactly what an access token can access.

Once your scopes are configured:

1. Review the app settings.
2. Save your changes.
3. Click Release to release the app version.

Your app must have a released version before installation.

---

Step 3: Install the App on Your Shopify Store

Now install the app.

Inside your app’s Dev Dashboard:

1. Open Home.
2. Find Install app.
3. Select the Shopify store you want to connect.
4. Click Install.
5. Review the requested permissions.
6. Approve the installation.

The app is now connected to your store, but you still need to authenticate it before making Shopify Admin API requests.

---

Step 4: Find Your Shopify Client ID and Client Secret

Open your app in the Shopify Dev Dashboard and go to:

Settings → Credentials

You should see:

Client ID

Example:

3750f4ece49d688246ee9c3ca581613f

Client Secret

Example only:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Copy both values somewhere secure temporarily.

Never publish your real Client Secret in documentation, screenshots, GitHub repositories, public websites, support tickets, or social media posts.

Shopify specifically recommends storing client secrets using environment variables or a dedicated secrets manager rather than including them directly in application code.

---

Step 5: Get Your Shopify Admin API Access Token Using Postman

This is the most important part.

You will exchange your Client ID and Client Secret for an Admin API access token.

1. Open Postman

Launch Postman and create a new HTTP Request.

2. Change the Request Method to POST

Next to the URL field, change:

GET

to:

POST

3. Enter the Shopify Token Endpoint

Enter:

https://YOUR-STORE.myshopify.com/admin/oauth/access_token

Replace YOUR-STORE with your Shopify store’s actual myshopify.com subdomain.

For example, if your permanent Shopify address is:

myfashionstore.myshopify.com

your endpoint becomes:

https://myfashionstore.myshopify.com/admin/oauth/access_token

Important: Use your .myshopify.com domain rather than a custom storefront domain such as example.com.

---

Step 6: Add the Authentication Details in Postman

Under the request URL, select:

Body → x-www-form-urlencoded

Add these three fields:

Key	Value
grant_type	client_credentials
client_id	Your Shopify Client ID
client_secret	Your Shopify Client Secret

Your request should therefore contain:

grant_type = client_credentials

client_id = YOUR_CLIENT_ID

client_secret = YOUR_CLIENT_SECRET

Shopify’s official client-credentials documentation uses these exact three parameters when requesting an access token.

Now click Send.

---

Step 7: Copy Your Shopify Admin API Access Token

If everything has been configured correctly, Shopify should return a JSON response similar to:

{
  "access_token": "YOUR_ACCESS_TOKEN",
  "scope": "read_products,write_products,read_inventory,write_inventory",
  "expires_in": 86399
}

The important value is:

access_token

That is your Shopify Admin API Access Token.

The scope field tells you which permissions are available to the token.

The expires_in field tells you how long the token remains valid.

For the client credentials grant, Shopify currently documents the token lifetime as 86399 seconds, or approximately 24 hours.

Important: The Token Is Not Permanent

This is another major difference between newer Shopify API authentication and many older tutorials.

A client-credentials access token expires after approximately 24 hours.

When it expires, send the same request again using:

• grant_type
• client_id
• client_secret

Shopify will return another valid access token.

For a production integration, this process should normally be automated rather than manually repeated in Postman.

---

Step 8: Test Your Shopify Admin API Access Token

You can optionally test the token directly inside Postman.

Create another POST request.

Use:

https://YOUR-STORE.myshopify.com/admin/api/2026-07/graphql.json

Under Headers, add:

Key	Value
Content-Type	application/json
X-Shopify-Access-Token	Your Access Token

Under:

Body → raw → JSON

enter:

{
  "query": "{ shop { name } }"
}

Click Send.

If authentication is working correctly, Shopify should return information about your store.

The important authentication header is:

X-Shopify-Access-Token

Shopify requires this access-token header for authenticated GraphQL Admin API requests.

---

What If You’re Connecting to a Client’s Shopify Store?

This distinction is extremely important.

The client credentials grant is intended for integrations acting on stores within your own Shopify organization.

If the Shopify store belongs to another organization—for example, you’re developing an integration for a client’s store—the same process might return:

shop_not_permitted

Shopify states that the client credentials grant cannot be used to access a store outside the organization containing the app. Apps distributed to other merchants should use an appropriate installation and authentication method such as Shopify’s authorization-code or token-exchange flows.

So the correct authentication method depends on your situation:

Situation	Recommended Authentication
Integration for your own Shopify organization	Client credentials grant
App installed on another merchant’s store	OAuth/authentication flow appropriate to the app
Embedded Shopify app	Token exchange
Shopify CLI application	Authentication generally handled by Shopify’s app tooling

This is why some tutorials online show a localhost/?code= authorization process while others use only a Client ID and Client Secret. They’re describing different authentication scenarios.

---

Common Shopify Admin API Token Errors

1. Invalid client

Check that your:

• Client ID is correct
• Client Secret is correct
• Credentials don’t contain accidental spaces
• App has been configured and installed correctly

Don’t use the Client ID itself as the Admin API access token.

---

2. shop_not_permitted

This usually happens when you’re trying to use the client credentials grant with a store outside the Shopify organization containing the app.

Shopify’s documentation specifically restricts this grant to stores within the same organization.

---

3. Invalid API key or access token

Make sure you’re sending the actual value returned as:

access_token

Do not send your:

• Client ID
• Client Secret

as the X-Shopify-Access-Token.

---

4. API Request Returns Permission Errors

Your token might be valid while lacking the required scope.

For example, an integration attempting to update inventory needs the appropriate inventory permissions.

Go back to your app’s Versions section and check its access scopes.

If scopes are changed, release the updated version and approve the updated permissions for the installed store. Shopify notes that changing scopes in an app version doesn’t automatically apply those permissions to existing installations.

---

5. I Can’t Find an Admin API Token in Shopify

This is normal for newly created Dev Dashboard apps.

Shopify no longer simply shows the token in the interface for this workflow. The application exchanges its credentials for an access token when it needs one.

This is one of the reasons older Shopify API tutorials can be confusing in 2026.

---

Shopify API Security Best Practices

Admin API credentials can provide significant access to a Shopify store, so they should be handled carefully.

Follow these basic security practices:

• Never publish your Client Secret.
• Never publish your Admin API access token.
• Never commit secrets to a public GitHub repository.
• Don’t include credentials in frontend JavaScript.
• Don’t send credentials through unsecured messaging platforms.
• Only request API scopes your integration actually requires.
• Store credentials using environment variables or a secure secret manager.
• Revoke or rotate credentials if you believe they’ve been exposed.

Treat your Client Secret like a password.

---

Frequently Asked Questions

How do I get a Shopify Admin API Access Token in 2026?

Create an app through Shopify’s Dev Dashboard, configure and release its API scopes, install the app, then retrieve its Client ID and Client Secret. For an integration operating on stores within your own Shopify organization, send those credentials to Shopify’s /admin/oauth/access_token endpoint using the client_credentials grant.

Where is the Admin API Access Token in Shopify?

For new Dev Dashboard apps using client credentials, Shopify doesn’t display a permanent Admin API token for you to copy. The token is requested programmatically using your Client ID and Client Secret.

Does a Shopify Admin API Access Token expire?

It depends on the authentication method. Shopify currently documents access tokens obtained through the client credentials grant as valid for approximately 24 hours. The token response includes an expires_in value, so integrations should use that value rather than assuming a token will remain valid indefinitely.

Does a Shopify Admin API token always start with shpat_?

Don’t build an integration around a particular token prefix. Treat the complete value Shopify returns in the access_token field as the credential.

Older Shopify documentation and integrations frequently reference shpat_ tokens, but authentication behavior has changed for newly created apps.

Can I generate the Shopify API token without coding?

Yes. Postman can be used to manually send the required POST request. You only need your Shopify store’s myshopify.com domain, Client ID, and Client Secret.

For a production system, however, token renewal should usually be automated.

What is the Shopify Admin API token used for?

It authenticates requests to Shopify’s Admin API. Depending on the app’s scopes, those requests can work with products, inventory, orders, customers, metafields, fulfillment data, and other Shopify resources.

Can I use the same token for multiple Shopify stores?

No. Shopify API authentication is tied to the relevant app/store context. You shouldn’t assume that a token generated for one Shopify store can access another.

What should I do if my Shopify API token stops working?

First check whether it has expired. If you’re using the client credentials grant, request a new token using your Client ID and Client Secret. Also check whether the app is still installed and whether its required scopes are still approved.

---

Final Thoughts

Getting a Shopify Admin API Access Token is more complicated than it used to be, mainly because Shopify has moved new app development into the Dev Dashboard and changed how newer applications authenticate.

For a server-side integration connecting to a store within your own Shopify organization, the basic process is now:

Create App → Configure Scopes → Release Version → Install App → Get Client ID & Secret → Send Client Credentials Request → Receive Access Token

You don’t need to create a localhost authorization URL or manually copy an authorization code for this particular authentication method.

Once the token has been generated, it can authenticate Shopify Admin API requests according to the permissions granted to your application.

Remember that client-credentials tokens expire after approximately 24 hours, so production integrations should automatically request a new token when required.

Most importantly, keep your Client Secret and Admin API credentials private. They provide access to valuable store data and should be protected with the same care as any other sensitive account credential.