# Shopify Admin API tokens (/integrations/shopify-service-account)

Connect a Shopify store with a **non-expiring offline Admin API access token** and its `.myshopify.com` domain. Sim stores the pasted token; this connection does not renew expiring tokens.

## Prerequisites \[#prerequisites]

You need store owner or staff permissions that allow managing apps on the store. You'll also need your store's permanent domain (`your-store.myshopify.com`) — Sim asks for it alongside the token.

Shopify no longer allows creating new custom apps from the store admin — that path is legacy. New custom apps are created from the **Dev Dashboard** ([dev.shopify.com](https://dev.shopify.com/)) or the Shopify CLI. If you already have an admin-created custom app, its `shpat_` token still works and can be pasted into Sim directly.

## Set up the custom app \[#setting-up-the-custom-app]

### 1. Create the app and grant scopes \[#1-create-the-app-and-grant-scopes]

Open the [Dev Dashboard](https://dev.shopify.com/), create a new app (e.g. `sim-workflows`), and connect it to your store

Configure the app's **Admin API access scopes**. The set Sim's Shopify tools use is:

```
write_products
write_orders
write_customers
write_inventory
read_locations
write_merchant_managed_fulfillment_orders
```

In Shopify, `write_X` includes `read_X`, so these six cover product, collection, order, fulfillment, customer, inventory, and location operations. Grant fewer if your workflows only read — e.g. `read_products` alone is enough for product and collection lookups

Install the app on your store, then obtain the `shpat_` token as described in the next section — the flow differs by app type

### 2. Get the Admin API access token \[#2-get-the-admin-api-access-token]

How you obtain the `shpat_` token depends on how the app was created:

- **Legacy admin-created custom apps** (created from the store admin before Shopify removed that path) show the **Admin API access token** — it starts with `shpat_` — once on the app's API credentials page. Reveal it, copy it immediately, and paste it into Sim. For legacy admin-created custom apps, Shopify shows the token only once, at creation — if you lose it, you have to reinstall or recreate the app to get a new one.
- **New Dev Dashboard apps** do **not** display a permanent `shpat_` token in any UI. Complete an [authorization code grant](https://shopify.dev/docs/apps/build/authentication-authorization/authenticate-standalone-apps) install and obtain a **non-expiring offline** access token. Check the token response and access mode: the `shpat_` prefix is also used by expiring tokens. The Dev Dashboard's client-credentials tokens are different — they expire after 24 hours and cannot be stored in Sim.

Warning:

Don't confuse the token types: `shpat_` is the Admin API access token Sim needs. `shpss_` is the app's client secret and `shpca_` identifies an older custom-app token format. Use the documented Admin API token for your app and confirm its lifetime; a client secret is not an access token. If your Dev Dashboard app only shows a client ID and secret, that is expected: Dev Dashboard apps issue tokens via OAuth, not a UI reveal (see the setup steps above).

### 3. Find your store domain \[#3-find-your-store-domain]

Use the permanent `.myshopify.com` domain — for example, `your-store.myshopify.com` — not your custom storefront domain. You can find it in your Shopify admin URL or under **Settings** → **Domains**.

## Add the Admin API token to Sim \[#adding-the-admin-api-token-to-sim]

Open **Integrations** from your workspace sidebar

Search for "Shopify" and open it, then click **Add to Sim** and choose **Add admin API token**

Paste the Admin API access token, enter the store domain (e.g. `your-store.myshopify.com`), and optionally set a display name and description

Click **Add admin API token**. Sim verifies the token with a scope-free `shop` query on the store’s GraphQL Admin API — if it fails, you'll see a specific error explaining what went wrong.

The token and store domain are encrypted before being stored.

## Use the credential in workflows \[#using-the-credential-in-workflows]

Add a Shopify block to your workflow. In the credential dropdown, select the saved Shopify Admin API token. Select it and configure the block as you normally would — the store domain stored with the credential is used automatically.

The block calls your store's Admin API (`your-store.myshopify.com/admin/api/...`) using the token, with exactly the scopes you granted the app.

## Token lifecycle and recovery \[#token-lifecycle-and-recovery]

A pasted credential must use a non-expiring offline token; Sim does not renew online, expiring offline, or 24-hour client-credentials tokens. A `shpat_` prefix alone does not establish the token’s lifetime. See [Shopify’s access-token reference](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens).

Tokens are scoped to the app’s installation on a store. Add a separate credential for each store. If an operation fails with access denied, review the app’s scopes and the store’s approval for protected data. Apply the scope change and re-authorize as required; update Sim if the procedure issues a replacement token.

Legacy admin-created custom apps reveal their token only once. If it is lost, uninstall/reinstall or recreate the app to issue a replacement. These procedures invalidate the old token, so plan the interruption and update Sim immediately. Do not apply that one-time UI recovery procedure to a Dev Dashboard app that obtains its token through OAuth.