--- title: "Shopify Lets You Script the Token, Not the App" url: https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt source_url: https://apievangelist.com/2026/08/21/shopify-app-registration-is-dashboard-only type: article source: "API Evangelist" published: 2026-08-21T00:09:27.920Z updated: 2026-08-21T00:09:53.569Z tags: ["architecture", "nodejs", "authentication", "oauth", "shopify"] reading_time: 12 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Shopify Lets You Script the Token, Not the App **[API Evangelist](https://daily.dev/sources/apievangelist)** · 12 min read · 0 upvotes · 0 comments ## Summary Shopify offers no public API to register an application and mint a client_id/client_secret — that step remains dashboard-only in the Partner Dashboard or store admin. What is scriptable is the OAuth authorization code grant that turns an existing app's credentials into a per-store Admin API access token, including HMAC verification, state checks, and a server-to-server token exchange. A companion Node.js script (18+, no dependencies) automates this token exchange, opening a browser, catching the redirect on a fixed local callback, verifying HMAC/state, and printing the offline (non-expiring) access token. The redirect URI still has to be manually allowlisted in the app settings once. The piece argues that platforms marketing 'agentic commerce' should also expose a Dynamic Client Registration endpoint or authenticated Partner API so app creation itself can be automated. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can I create a Shopify app or get a client_id and client_secret through an API call? No, Shopify has no public endpoint to mint a client_id and client_secret. Apps must be created by hand in the Partner Dashboard, where you click through forms and copy the API key and secret from the credentials screen; custom apps require a store owner to generate an Admin API access token manually in their own admin. _Developers automating Shopify integrations follow analysis like this on daily.dev to spot workarounds for dashboard-only steps._ ### What is the OAuth flow for getting a Shopify Admin API access token programmatically? Using an existing app's client_id and client_secret, you redirect a merchant's browser to https://{shop}.myshopify.com/admin/oauth/authorize with the client ID, scopes, redirect_uri, and a state nonce; after approval Shopify redirects back with a code, shop, and hmac. You verify state and hmac, then POST to https://{shop}.myshopify.com/admin/oauth/access_token with client_id, client_secret, and code to receive the access token, used afterward in the X-Shopify-Access-Token header. _Teams scripting Shopify OAuth exchanges track flow details like this through daily.dev._ ### How is the Shopify OAuth callback HMAC calculated to verify it came from Shopify? Shopify signs all callback query parameters except hmac and the legacy signature field: the keys are sorted alphabetically, joined as key=value pairs with '&', and that string is hashed with HMAC-SHA256 using the app's client secret, producing a hex digest that must match the hmac value in the callback using a timing-safe comparison. _Developers hardening OAuth callback security reference concrete details like this via daily.dev._ ## Similar posts on daily.dev - [Slack Can Actually Mint App Credentials From a Script, If You Survive the Bootstrap](https://daily.dev/posts/slack-can-actually-mint-app-credentials-from-a-script-if-you-survive-the-bootstrap-6xzzokqtq) · API Evangelist · 0 upvotes · 0 comments - [GitHub Quietly Built the Onboarding Flow Everyone Else Is Missing](https://daily.dev/posts/github-quietly-built-the-onboarding-flow-everyone-else-is-missing-gk4jwdvby) · API Evangelist · 0 upvotes · 0 comments - [Cloudflare Hands You a Token, but Only If You Click Through the Dashboard First](https://daily.dev/posts/cloudflare-hands-you-a-token-but-only-if-you-click-through-the-dashboard-first-bi8d2lr7q) · API Evangelist · 1 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#nodejs](https://daily.dev/tags/nodejs), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt)