Access Permission for Shopify API

Shopify API authentication is critical for developers to securely interact with the Shopify platform. Building powerful applications requires understanding API access levels in Shopify and Shopify API permissions. Properly managing Shopify API key access and Shopify API scope ensures that apps only access the data they are allowed to, which is the key to effective Shopify API access control and secure API access Shopify.

1. Creating Apps and Authenticating

Creating Apps

In Shopify Admin, you can create custom, private or public apps for stores using your partner account. To authenticate the app, you need to install it from a Shopify admin to generate the necessary API credentials and access tokens.

This process is important to ensure Shopify App API authorization and Shopify API authentication.

2. API Requirements

The user must have a Shopify collaborator account for the app the user working with has created a Shopify store, then the user must give the permissions to create the custom app and assign Shopify API scopes.

Properly managing Shopify API permissions and ensuring proper Shopify API permission settings are critical to maintaining Shopify API access control and securing API access on Shopify.

3. Follow the Steps Required for Access Permissions:

Step 1: Create a New Application

Create and install custom or private apps in the Shopify admin store. You can manually create apps from partner accounts or use the Shopify CLI with the following command:

Cmd: npm init @shopify/app@latest

Step 2: Make Authentication Requests to the API

After creating the app, authenticate requests to the REST Admin API or GraphQL Admin API using the access token generated when the app is installed on the Store. This process involves Shopify API authentication and using generated credentials for Shopify API Key access.

To make API requests to Postman and the graphical explorer tools

Create a request to the REST Admin API or Graphql Admin API You need the following parameters to create a URL:

• API Key: The Shopify API key is taken from the app admin of the client credentials, i.e., the client ID shown in the above screen.
• Token: An access token is available after installing the app on the store.
• Shop:  App installed on the store is available in store name.

Graphql URL: https://{{api-key}}:{{token}}@{{shop}}/admin/api/2023-01/graphql.json

REST URL: https://{{api-key}}:{{token}}@{{shop}}/admin/api/2023-01/products.json

https://{{api-key}}:{{token}}@{{shop}}/admin/api/2023-01/shop.json 

Using GraphiQL Explorer and Postman

GraphiQL Explorer Tool

Ideal for testing and debugging GraphQL queries. It provides an interactive interface for exploring GraphQL schemas and executing queries.

Postman tool

Useful for making HTTP requests and analyzing API responses. Postman allows you to test different endpoints and understand how your API interacts with Shopify.

Get the AccessScopes resources allows to retrieve the Shopify API permissions using shopify admin rest api that a merchant has granted to an app like read_orders, write_customers  and write_products. This allows you to review the Shopify API permission settings.

REST URL: https://{{api-key}}:{{token}}@{{shop}}/admin/oauth/access_scopes.json 

This URL provides a list of Shopify API permission settings and scopes granted to the application, helping to effectively manage API permissions in Shopify.

Rotating API Credentials

To update app credentials, rotate access token from admin or uninstall and reinstall your app, follow the required procedure. This ensures that Shopify API authentication remains secure and adheres to secure API access practices.

Access Tokens for the Storefront API

The Storefront API requires a valid Shopify access token:

• Public Access Token: Used to make Storefront API requests from public contexts such as browsers. Include the X-Shopify-Storefront-Access-Tokens header in client-side requests.
• Private Access Token: Used for server-side queries on the StoreFront API. Include the Shopify-Storefront-Private-Token header in server-side requests.

Note: Apps can have a maximum of 100 active storefront access tokens per shop.

Permissions Required for Custom Apps

The following screens explain the store permissions an employee or associate account needs to assign the admin API access scope to an admin-created app, ensuring proper Shopify API access control. This step is critical to effectively managing API permissions in Shopify and configuring the appropriate Shopify API permission settings.

Conclusion

The permissions required to access the Shopify REST admin API and GraphQL admin API using an API access token are generated when the application is installed on the partner store.

Looking for custom Shopify app development? We can develop the ideal app for your store. Contact us to get started!