Before you start — what you’ll need
- Store owner or a staff account with the "Develop apps" permission. Regular staff can’t create custom apps.
- Two minutes and a safe place to paste the token (a password manager, not a chat or a sticky note).
- A clear idea of what the token is for — that decides which scopes you grant.
If a tool asked you for a "Shopify Admin API access token" or an "shpat_ token" and you have no idea where that lives, you’re in the right place. It sounds technical, but it’s really just five clicks inside your own Shopify admin. Below is the exact path, which permissions to tick, and how to not shoot yourself in the foot on security. No code required.
What the Admin API token actually is (30 seconds)
Shopify keeps your store’s data — orders, products, customers, fulfilment — behind an API. To let an outside app or your own script read and write that data, Shopify issues a secret key called an Admin API access token. It always starts with shpat_. You create it by making a custom app inside your admin and choosing exactly what it’s allowed to touch. Think of it as a keycard you cut yourself and hand to one specific tool — and can revoke any time.
Step-by-step: create the app and get the token
Here’s the full navigation path, then each step in detail:
- Open your Shopify admin and click Settings at the bottom-left of the sidebar.
- Go to Apps and sales channels, then click Develop apps near the top. The first time, you’ll see a prompt to Allow custom app development — confirm it (only the store owner can enable this once).
- Click Create an app. Give it a clear name like "Kwikfy Integration" so you remember what it’s for later, and hit Create app.
- Open the Configuration tab and click Configure under Admin API integration. Now tick the scopes (permissions) the tool needs — see the table below — and Save.
- Go to the API credentials tab and click Install app, then confirm. Shopify now generates the token.
- Under Admin API access token, click Reveal token once. Copy it immediately — it starts with
shpat_and Shopify will not show it in full again. Paste it wherever the integration asked for it.
That’s it — the token is live the moment the app is installed. If you ever lose it, you don’t "find" it again; you uninstall/reinstall (or recreate) the app to issue a fresh one.
Which scopes to tick (don’t over-grant)
Scopes are permissions. The golden rule: grant the minimum the tool needs, nothing more. You can always add scopes later. For a typical order / checkout / WhatsApp / shipping integration, this is the common set:
| Scope | What it lets the tool do |
|---|---|
| read_orders, write_orders | See and update orders (status, tags, notes, COD/prepaid) |
| read_products | Read your catalogue and variants |
| read_customers (write_customers if needed) | Read customer name/phone/address; edit only if the tool manages customers |
| read_fulfillments, write_fulfillments | Read and create shipments / fulfilment |
| read/write_merchant_managed_fulfillment_orders | Handle fulfilment-order workflows for shipping |
Admin token vs Storefront token — don’t mix them up
Shopify has two different tokens and people paste the wrong one all the time:
- Admin API access token (shpat_...) — private, server-side, manages your store’s data. This is the one an operations tool wants.
- Storefront API token — public, for building customer-facing storefronts, exposes only storefront data. Wrong tool for connecting a backend integration.
If a tool rejects your token or "can’t read orders", the classic cause is that you pasted the Storefront token, or the app is missing the read_orders scope.
Keep the token safe
- Treat it like a password. Anyone with it can act on your store. Never paste it into a public chat, screenshot, or a page that could be indexed.
- Store it in a password manager or the tool’s own secure field — not a Google Doc or WhatsApp message.
- Rotate it if it leaked, was shared, or a staff member with access leaves — uninstall/recreate the app to invalidate the old one.
- One app per integration. Separate custom apps make it easy to revoke access to one tool without breaking the others.
Common errors (and the fix)
| What you see | Usual cause & fix |
|---|---|
| "Develop apps" is greyed out | Custom app development not enabled, or you’re not the store owner. Ask the owner to allow it once. |
| 401 / "not authorized" | App not installed, or the token was copied wrong. Re-install and re-copy the full shpat_ string. |
| "can’t read orders" / 403 on a scope | Missing scope. Add read_orders (or the relevant scope), save, and re-install. |
| Token field is blank / can’t reveal again | It’s shown only once at install. Uninstall & reinstall the app to get a fresh token. |
Connecting to Kwikfy? Even simpler.
Kwikfy walks you through creating the custom app and pasting the token in a guided setup — then syncs your Shopify orders two-way, adds a high-converting checkout, WhatsApp automation and RTO control on top. No code.
Connect Your Store Free →And that’s the whole thing: a custom app, the right scopes, one reveal-and-copy, and store the token like a password. Do it once and any tool that speaks the Shopify Admin API — including your order, checkout and WhatsApp stack — can plug straight into your store.