How do you get an Admin API access token for a Shopify custom app?

Why is there no token to copy in your Shopify admin?

A tool or a developer asks for your Admin API access token, and the admin has none to show. That is expected today: starting January 1, 2026, you can't create any more legacy custom apps in the admin, and new custom apps are created in the Dev Dashboard. Legacy apps made before that date are unaffected and, as of October 2026, continue to work.

For a Dev Dashboard app, Shopify's developer docs say plainly that you won't see a token in the Shopify admin. Instead, your developer uses the client credentials grant: the app's client ID and secret go into a programmatic request to Shopify's token endpoint, and the token comes back. The Help Center adds that this process requires developer knowledge and can't be completed directly from your Shopify admin.

The token is not permanent either. Tokens expire after 24 hours, so whatever uses one has to request a fresh token before it runs out.

How do you create the app and get the token?

The first four steps are yours, if you own the store or have the permissions listed below; the last two are your developer's. The Help Center steps start in the admin:

In Shopify admin

1. Settings
2. Apps
3. Develop apps
4. Build apps in Dev Dashboard

Then click Create app.

Zoom

UI checked October 15, 2026 in our development store

1. Create the app in the Dev Dashboard.
2. Create a version: set the App URL, the Webhooks API version and the scopes the app needs, then Release it. Your app must have at least one version before it can be installed on a store.
3. Install the app on your store.
4. Find the Client ID and Client secret in the Dev Dashboard.
5. Your developer exchanges both for the access token with the client credentials grant.
6. Your developer includes the token in the X-Shopify-Access-Token header when calling Shopify APIs, and requests a new one before the 24 hours run out.

Scopes are set on the app's version, not in the token request. The token response only reads back what you selected, so adding a scope means releasing a new version, and Shopify notes the update isn't applied automatically to stores where the app is already installed: you still need to approve the new scopes manually in your Shopify admin.

The video below, from the Coding with Jan channel (February 2026), shows registering the app, picking scopes and installing it. Its token step differs from this page: it exchanges an OAuth authorization code for the token in Postman, not the client credentials request of step 5. Follow Shopify's documentation for the steps.

API key, API secret or access token: which one does a tool need?

A Dev Dashboard app gives you three strings, and only one of them is the token. Shopify's credentials page confirms that some tools and documentation call the first two the API key and API secret.

Shopify.dev, read October 15, 2026.

Only the token goes into API calls. Offline and online Admin API access tokens are opaque strings that begin with shpat_, whichever grant produced them. Sending your client ID or client secret directly to the GraphQL Admin API is a problem Shopify lists for the client credentials grant: the two have to be exchanged for a token first.

Shopify also acknowledges that some external tools ask you to copy a token or provide a “Shopify API key.” With a Dev Dashboard app you can't copy an access token from your Shopify admin, and Shopify says these tools expect the older authentication flow; its advice is to contact the tool vendor about updating their integration to use OAuth.

Who on your team can create the app?

The App development permissions decide who can follow these steps:

• Store owners automatically have full access to create and manage custom apps.
• Staff need the App development > Develop permission, which lets them create and update custom apps installed on your store.
• Enable development lets a user permit other users and collaborators to develop custom apps, which by default isn't permitted; it also requires Manage and install apps and channels.

Inside the Dev Dashboard, a user of a merchant store gets access through the App developer role; stores on the Plus plan can also create custom roles with Dev Dashboard permissions. Our store access permissions guide shows how this fits the rest of a staff role.

Zoom

Can a developer or agency create it from their own account?

Not with the client credentials grant. It only works when the app and the store belong to the same Shopify organization, and a Dev Dashboard custom app can be installed only in other stores of that same organization. Client credentials can't reach a store outside your organization, including a client's store; that case needs custom distribution and a different grant, which is developer territory.

A collaborator account does not change this: collaborators can't access the Dev Dashboard because they don't have organization-level permissions. So someone inside your organization, you or permitted staff, creates and installs the app, and the developer works from its client ID and secret.

Shopify itself warns that creating a custom app requires development knowledge and can be challenging. If no one on your team can make the token request, our guide to getting Shopify development help sorts out whom to bring in.

What if you already have a legacy custom app?

If you or a developer created a legacy custom app in the admin before January 1, 2026, you can get its Admin API access token from your Shopify admin after you install the app. The app itself is managed here:

You can reveal that token only one time. The shopify.dev page on admin-created custom apps adds that you can't rotate their API key or secret; to generate a new access token, you uninstall and reinstall the app from the Shopify admin. A Dev Dashboard app is different: its secret can be rotated without downtime if the rotation steps are followed in order.