Shopify Admin API Access Token Helper

Build the client credentials request for a Dev Dashboard app as curl, Node or Python, with a scope checklist.

Your details

Store domain

Client ID

Client secret

This runs entirely in your browser and nothing is sent anywhere. Still, treat any secret you've typed into a page you don't control as one you should be ready to rotate.

Scopes you're using (for your notes, not sent anywhere)

Show as

Token request

curl -X POST "https://your-store.myshopify.com/admin/oauth/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"

# Response: { "access_token": "…", "scope": "…", "expires_in": 86399 }
# Use the token in an X-Shopify-Access-Token header on your Admin API requests.

This grant only works when your app and the store are in the same organization in the Dev Dashboard. For a store outside your organization, install the app there and use the token Shopify generates on install instead.

Tokens from this grant expire in 86,399 seconds (24 hours) and aren't visible anywhere in the admin, only from this request. Request one whenever you need it, or cache and refresh it before it expires.

Keep the client secret in an environment variable or secret manager, never in code you commit. Request only the scopes you actually use.

The client credentials grant

Apps built through Shopify's Dev Dashboard get an Admin API access token by exchanging their client ID and client secret for one, rather than seeing a token in the admin. This only works when your app and the target store are in the same Dev Dashboard organization.

POST https://{shop}.myshopify.com/admin/oauth/access_token Content-Type: application/x-www-form-urlencoded grant_type=client_credentials&client_id={id}&client_secret={secret}

The response includes access_token, scope and expires_in (always 86399 seconds, 24 hours).

Use the returned token in an X-Shopify-Access-Token header on your Admin API requests. Since it expires in 24 hours, request a fresh one when you need it, or cache it and refresh shortly before it expires.

About scopes

Only request the access scopes your app actually uses, like read_products or write_orders. The scopes field here is just for your own notes; it isn't sent anywhere by this tool. Shopify's access scopes reference lists every available scope and what it unlocks.

Questions people ask

Why doesn't this work for a store outside my organization?

The client credentials grant only issues tokens for stores in the same Dev Dashboard organization as your app. For any other store, install the app there normally; Shopify generates a token automatically on install.

Is my client secret sent anywhere by this tool?

No, everything runs in your browser and the code is only assembled locally. Still, treat a secret you've typed into any page you don't control as one worth rotating.

How long does the token last?

Always 86,399 seconds (just under 24 hours), per Shopify's own response. There's no way to request a longer-lived token from this grant.

Where do I find my client ID and secret?

In the Dev Dashboard, open your app and go to its API credentials page.

Last reviewed 30 September 2026.

Sources: Shopify.dev: get API access tokens for Dev Dashboard apps