Shopify custom apps in 2026: why there is no Admin API token to copy, and how to request one

A client or a tool asks for "the Admin API access token", you open the Shopify admin, and there is nothing to copy. This is expected behavior now, not a permissions problem. This post covers why, the flow that replaces it, how to tell the client ID, the secret and the token apart, and the constraint that trips agencies up: it only works inside one Shopify organization. Everything here comes from Shopify's Help Center and shopify.dev pages, read October 15, 2026.

Why the admin shows no token

Starting January 1, 2026, you can't create any more legacy custom apps in the admin, and new custom apps are created in the Dev Dashboard. Legacy apps made before that date are unaffected and, as of October 2026, continue to work.

For a Dev Dashboard app, Shopify's developer docs say you won't see a token in the Shopify admin. Instead you use the client credentials grant: the app's client ID and secret go into a programmatic request to Shopify's token endpoint, and the token comes back. The Help Center adds that this process requires developer knowledge and can't be completed directly from your Shopify admin.

The token is also short-lived. Per Shopify's client credentials page, tokens expire after 24 hours, so whatever uses one has to request a fresh token before it runs out. If you have a long-running integration, that request belongs in code, not in a runbook.

The flow, step by step

The first four steps happen in the admin and Dev Dashboard, usually by the store owner or a staff member with the right permission; the last two are the developer's. The path starts at Settings > Apps > Develop apps > Build apps in Dev Dashboard, then Create app.

1. Create the app in the Dev Dashboard.
2. Create a version: set the App URL, the Webhooks API version and the scopes the app needs, then Release it. Your app must have at least one version before it can be installed on a store.
3. Install the app on your store.
4. Find the Client ID and Client secret in the Dev Dashboard.
5. Exchange both for the access token with the client credentials grant.
6. Include the token in the X-Shopify-Access-Token header when calling Shopify APIs, and request a new one before the 24 hours run out.

A detail worth knowing before you debug scopes: they are set on the app's version, not in the token request. The token response only reads back what you selected. Adding a scope means releasing a new version, and Shopify notes the update isn't applied automatically to stores where the app is already installed; someone still has to approve the new scopes manually in the Shopify admin.

A caution about tutorials. One video from the Coding with Jan channel (February 2026) registers the app in the Dev Dashboard correctly, but exchanges an OAuth authorization code for the token in Postman, not the client credentials request of step 5. Treat videos as a tour of the UI and follow Shopify's documentation for the token step.

Client ID, client secret, access token

A Dev Dashboard app gives you three strings, and only one of them is the token. Shopify's credentials page confirms that some tools and documentation call the first two the API key and API secret.

Credential	Also called or looks like	Where it comes from	Can it change?
Client ID	API key (SHOPIFY_API_KEY)	Dev Dashboard	No, it is permanent
Client secret	API secret (SHOPIFY_API_SECRET)	Dev Dashboard	Yes, without downtime if the rotation steps are followed in order
Access token	A string that starts with shpat_	Requested from the token endpoint	Expires after 24 hours

Only the token goes into API calls. Offline and online Admin API access tokens are opaque strings that begin with shpat_, whichever grant produced them. Sending your client ID or client secret directly to the GraphQL Admin API is a problem Shopify lists for the client credentials grant: the two have to be exchanged for a token first.

Some external tools still ask you to copy a token or provide a "Shopify API key". With a Dev Dashboard app you can't copy an access token from the admin, and Shopify says these tools expect the older authentication flow. Its advice is to contact the tool vendor about updating their integration to use OAuth.

The organization constraint

The client credentials grant only works when the app and the store belong to the same Shopify organization, and a Dev Dashboard custom app can be installed only in other stores of that same organization. It can't reach a store outside your organization, including a client's store. That case needs custom distribution and a different grant, which is a separate design decision from the one described here.

A collaborator account does not change this: collaborators can't access the Dev Dashboard because they don't have organization-level permissions. So someone inside the organization creates and installs the app, and the developer works from its client ID and secret.

On permissions: store owners automatically have full access to create and manage custom apps. Staff need the App development > Develop permission. Inside the Dev Dashboard, a user of a merchant store gets access through the App developer role.

If you already have a legacy custom app

For an app created in the admin before January 1, 2026, you can get its Admin API access token from the admin after you install the app (Settings > Apps > Legacy custom apps). You can reveal that token only one time.

The shopify.dev page on admin-created custom apps adds that you can't rotate their API key or secret; to generate a new access token, you uninstall and reinstall the app from the admin. A Dev Dashboard app is different: its secret can be rotated without downtime if the rotation steps are followed in order.

Store the legacy token somewhere secure the moment it appears. Uninstalling to get a new one deregisters resources such as webhooks, carrier services and inventory integrations, which you then need to register again with the new token. And do not delete the app itself: you can't create a new legacy custom app to replace it.

The original FAQ, with each claim tied to its Shopify source, is at How do you get an Admin API access token for a Shopify custom app?

Our content is AI-generated and fact-checked against official Shopify sources.