Shopify Admin API access token: how to get it in 2026

Where you find a Shopify Admin API access token depends on where you created the app. An app from the Shopify Dev Dashboard shows no token: you exchange its client ID and client secret for an access token that is valid for 24 hours. A legacy custom app, created in the Shopify admin before 2026, shows its token only once, under API credentials.

Since January 1, 2026 you can no longer create custom apps in the Shopify admin, so the old "Develop apps" route to a new Admin API access token is gone. Custom apps created before that date keep working. Source: Shopify changelog.

Connecting Shopify to Afosto? Then you don't request a token yourself. Go straight to Connecting Shopify to Afosto.

Where to find Admin API access token

Shopify only shows a token for a legacy custom app. For an app from the Dev Dashboard, you request the token yourself.

Lost the token of a legacy custom app? Uninstall and reinstall the app to get a new one. Uninstalling removes the app's webhooks, carrier services and inventory integrations, so your developer has to register them again with the new token.

Don't delete the app: you can't create a new legacy custom app to replace it. Sources: Shopify Help Center and shopify.dev.

How to get a Shopify access token with client credentials

For an app that works on stores in your own Shopify organization, you use the client credentials grant. The app exchanges its own client ID and secret for a token, without a redirect flow.

1. Log in at dev.shopify.com/dashboard, go to Apps and click Create app. Choose Start from Dev Dashboard, name the app and click Create.

2. On the Versions page, enter the scopes you need under Access and click Release. If the app doesn't run inside the Shopify admin, you can use the default app URL https://shopify.dev/apps/default-app-home.

3. Click Install app on the Installs card, choose your store and click Install.

4. Go to Settings and copy the Client ID and Client secret under Credentials. Some tools call these the API key and API secret.

5. Exchange them for a token at your store's token endpoint:

curl -X POST "https://your-store.myshopify.com/admin/oauth/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Shopify answers with the token, the granted scopes and the lifetime in seconds:

{
  "access_token": "f85632530bf277ec9ac6f649fc327f17",
  "scope": "read_products",
  "expires_in": 86399
}

Send the access_token in the X-Shopify-Access-Token header of every Admin API request. After 24 hours it expires, and you get a new one by sending the same request again. Keep the client secret out of your code and out of version control.

Client credentials only work when the app and the store belong to the same Shopify organization. Staff need the App development > Develop permission, and collaborator accounts can't open the Dev Dashboard.

Does a tool ask you to paste a token, a "Shopify API key" or a SHOPIFY_ADMIN_ACCESS_TOKEN? Then it expects the flow from before 2026. Ask the vendor to switch to OAuth, because a token you request yourself expires after 24 hours.

Connecting Shopify to Afosto

For Afosto you don't create or renew a token yourself. You create the app in the Dev Dashboard and give Afosto its client ID and client secret. Afosto exchanges them for an access token and requests a new one when it expires.

1. Log in at dev.shopify.com/dashboard and create an app under Apps > Create app.
2. Fill in the app URL, redirect URL and scopes from step 3 of How to connect Shopify to Afosto, then release the app and install it on your store.
3. Copy the client ID and client secret under Settings > Credentials and send them to support@afosto.com.

The Afosto guide has every field and screenshot. What the connection keeps in sync, from orders to stock, is on the Shopify order connection page.

Scopes the Afosto connection uses

• read_assigned_fulfillment_orders
• read_fulfillments
• read_inventory
• read_locations
• read_merchant_managed_fulfillment_orders
• read_orders
• read_product_listings
• read_products
• read_publications
• read_returns
• write_fulfillments
• write_inventory
• write_merchant_managed_fulfillment_orders
• write_orders
• write_returns

Afosto checks these scopes when you connect and reports any that are missing. Forgot one? Add it in a new app version in the Dev Dashboard, release it and approve the change in your Shopify admin.

Already have a custom app from before 2026?

A custom app you created in the Shopify admin before January 1, 2026 keeps working, and you can still manage it from the Shopify admin. If your Afosto connection already runs on its access token, you do not need to change anything. The steps for that setup are in Connect Shopify to Afosto with an access token.