Give an AI agent safe write access to Shopify

What an agent can actually hold

Our previous guide put the theme in Git and let the agent work a branch. This one answers the question that arrives the moment that works: what credential is in the agent’s environment when it runs shopify theme push or updates a price through the Admin API? Most stores answer it badly. The founder’s login gets pasted into a config file because it was quicker, and the agent now holds payouts, staff, domains and customer exports in order to change a Liquid file. This guide sits in our UK engineering and compliance work and extends the Git and preview-theme workflow rather than repeating it.

Shopify gives you three credentials that can be scoped, and one that cannot.

The one that cannot be scoped is a login. A staff account, a collaborator account or the owner’s own credentials carry whatever the role allows, in the admin and through the CLI, and these are the things a theme edit never needs:

The access ladder

Think of access as a ladder and climb only as far as the job needs. The bottom rung is the Dev MCP: the agent can read every doc and validate every query with no credential at all, which is enough for a surprising amount of planning. The next rung is a read-only custom app, read_products and read_orders, so the agent can inspect the catalogue and reason about it without being able to change a thing. Theme work climbs one more rung, to a Theme Access password on an unpublished theme, where a mistake is a preview nobody sees. Only a job that genuinely writes data, a price sync or a metafield backfill, earns a write scope, and it earns exactly one. The top rung is a login, and no job earns that.

If the store already carries a pile of apps and tokens nobody remembers issuing, that inventory is the first job, before any agent is connected: a hardening pass over the store’s apps, tokens and staff permissions takes a day and removes the credentials that would otherwise become the agent’s by accident.

The activity log matters more than it looks. From Settings, General, the Store activity log lists recent actions with the name of the person or app that performed each one. It holds the 250 most recent actions and cannot be filtered or exported, so it is a review tool, not an audit trail; still, an agent that acts as a named app is visible there, and one acting as the founder is invisible. Shopify: activity logs in the admin

Tokens, scopes and rotation

Three details decide whether the middle lane is safe in practice. First, scopes come in read and write pairs, and you choose them per app version, so the agent’s token cannot reach a resource the version never declared. Shopify: access scopes. Second, rate limits are per app and store: the GraphQL Admin API restores 100 points a second on a standard plan, 200 on Advanced, 1,000 on Plus and 2,000 on Enterprise, and no single query may cost more than 1,000 points, so a badly written agent loop throttles itself rather than the store. Shopify: API limits. Third, versions: Shopify releases an API version every quarter and supports each for at least twelve months, so pin the version in every request and let the agent see the date in the URL. Shopify: API versioning

The pattern we ship is small. The client secret lives in a secrets manager, a short script exchanges it for a 24-hour token, and the agent’s environment receives only that token. Putting the exchange behind a small integration service that owns the secret and issues nothing longer-lived than the job is what turns rotation from a calendar reminder into a property of the system.

// token.mjs: a 24-hour token for a Dev Dashboard custom app, then one read.
// The client secret lives in your secrets manager, never in the agent's prompt.
const shop = process.env.SHOPIFY_SHOP; // your-store.myshopify.com

const grant = await fetch(`https://${shop}/admin/oauth/access_token`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: process.env.SHOPIFY_CLIENT_ID,
    client_secret: process.env.SHOPIFY_CLIENT_SECRET,
    grant_type: "client_credentials",
  }),
});
const { access_token, expires_in } = await grant.json(); // expires_in: 86399

// Hand the agent only access_token. It dies in 24 hours and carries only the
// scopes on the app version, so read_products here cannot touch an order.
const res = await fetch(`https://${shop}/admin/api/2026-07/graphql.json`, {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-Shopify-Access-Token": access_token },
  body: JSON.stringify({ query: "{ products(first: 5) { nodes { id title } } }" }),
});
const { data, extensions } = await res.json();
console.log(data.products.nodes, extensions.cost.throttleStatus); // points left in the bucket

One more line of defence costs nothing: Shopify tokens carry recognisable prefixes, and GitHub’s secret scanning lists Shopify access tokens among its partner patterns, so a token that lands in a repository is flagged rather than sitting there quietly. Treat the flag as a rotation, not a false positive. GitHub: supported secret scanning patterns

What breaks in production

For this guide we went through our own Shopify delivery records. Client names are withheld. These are the access failures that actually cost time or trust, and the rule each one taught.

1. Write the scope list before the prompt. If you cannot name the scopes a job needs, the agent is not ready to run it. Read scopes are the default; a write scope is a decision with an owner.
2. Preview themes and dry runs are the safety net, not the token. A perfectly scoped write_products token will still overwrite two thousand prices if the job has no dry run. Scope limits the blast radius; preview and rollback limit the damage inside it.
3. Rotation is a property of the credential, not a task for a person. Choose credentials that expire, and put the ones that do not on a migration list.

The Agent Blast Radius Score

The Agent Blast Radius Score is our triage model for access an agent already holds. It does not say whether the agent is any good. It says how much a bad afternoon could cost, and how urgently to re-key.

A theme agent on a Theme Access password against an unpublished theme, in a repository with Theme Check, scores one or two. The same agent given the founder’s login because it was quicker scores nine before it has done anything.

A real boundary: the app has to be born in the merchant’s organisation

Recommendations by business type

Primary sources

• Shopify: manage theme access (Theme Access app)
• Shopify changelog: legacy custom apps can’t be created after January 1, 2026
• Shopify: admin-created custom apps (legacy)
• Shopify: get API access tokens for Dev Dashboard apps
• Shopify: create apps using the Dev Dashboard
• Shopify: API access scopes
• Shopify: API rate limits
• Shopify: API versioning
• Shopify: Dev MCP server
• Shopify: activity logs in the Shopify admin
• Shopify: collaborator accounts
• GitHub: supported secret scanning patterns

Technical and operational guidance, not legal advice.