Shopify offers no public API to register an application and mint a client_id/client_secret — that step remains dashboard-only in the Partner Dashboard or store admin. What is scriptable is the OAuth authorization code grant that turns an existing app's credentials into a per-store Admin API access token, including HMAC verification, state checks, and a server-to-server token exchange. A companion Node.js script (18+, no dependencies) automates this token exchange, opening a browser, catching the redirect on a fixed local callback, verifying HMAC/state, and printing the offline (non-expiring) access token. The redirect URI still has to be manually allowlisted in the app settings once. The piece argues that platforms marketing 'agentic commerce' should also expose a Dynamic Client Registration endpoint or authenticated Partner API so app creation itself can be automated.
Questions this post answers
Can I create a Shopify app or get a client_id and client_secret through an API call?
No, Shopify has no public endpoint to mint a client_id and client_secret. Apps must be created by hand in the Partner Dashboard, where you click through forms and copy the API key and secret from the credentials screen; custom apps require a store owner to generate an Admin API access token manually in their own admin. Developers automating Shopify integrations follow analysis like this on daily.dev to spot workarounds for dashboard-only steps.
What is the OAuth flow for getting a Shopify Admin API access token programmatically?
Using an existing app's client_id and client_secret, you redirect a merchant's browser to https://{shop}.myshopify.com/admin/oauth/authorize with the client ID, scopes, redirect_uri, and a state nonce; after approval Shopify redirects back with a code, shop, and hmac. You verify state and hmac, then POST to https://{shop}.myshopify.com/admin/oauth/access_token with client_id, client_secret, and code to receive the access token, used afterward in the X-Shopify-Access-Token header. Teams scripting Shopify OAuth exchanges track flow details like this through daily.dev.
How is the Shopify OAuth callback HMAC calculated to verify it came from Shopify?
Shopify signs all callback query parameters except hmac and the legacy signature field: the keys are sorted alphabetically, joined as key=value pairs with '&', and that string is hashed with HMAC-SHA256 using the app's client secret, producing a hex digest that must match the hmac value in the callback using a timing-safe comparison. Developers hardening OAuth callback security reference concrete details like this via daily.dev.