Shopify Admin API tokens

Connect a Shopify store with a non-expiring offline Admin API access token and its .myshopify.com domain. Sim stores the pasted token; this connection does not renew expiring tokens.

Prerequisites

You need store owner or staff permissions that allow managing apps on the store. You'll also need your store's permanent domain (your-store.myshopify.com) — Sim asks for it alongside the token.

Shopify no longer allows creating new custom apps from the store admin — that path is legacy. New custom apps are created from the Dev Dashboard (dev.shopify.com) or the Shopify CLI. If you already have an admin-created custom app, its shpat_ token still works and can be pasted into Sim directly.

Set up the custom app

1. Create the app and grant scopes

Open the Dev Dashboard, create a new app (e.g. sim-workflows), and connect it to your store
2
Configure the app's Admin API access scopes. The set Sim's Shopify tools use is:
text
```
write_products
write_orders
write_customers
write_inventory
read_locations
write_merchant_managed_fulfillment_orders
```
In Shopify, write_X includes read_X, so these six cover product, collection, order, fulfillment, customer, inventory, and location operations. Grant fewer if your workflows only read — e.g. read_products alone is enough for product and collection lookups
Install the app on your store, then obtain the shpat_ token as described in the next section — the flow differs by app type

2. Get the Admin API access token

How you obtain the shpat_ token depends on how the app was created:

Legacy admin-created custom apps (created from the store admin before Shopify removed that path) show the Admin API access token — it starts with shpat_ — once on the app's API credentials page. Reveal it, copy it immediately, and paste it into Sim. For legacy admin-created custom apps, Shopify shows the token only once, at creation — if you lose it, you have to reinstall or recreate the app to get a new one.
New Dev Dashboard apps do not display a permanent shpat_ token in any UI. Complete an authorization code grant install and obtain a non-expiring offline access token. Check the token response and access mode: the shpat_ prefix is also used by expiring tokens. The Dev Dashboard's client-credentials tokens are different — they expire after 24 hours and cannot be stored in Sim.

3. Find your store domain

Use the permanent .myshopify.com domain — for example, your-store.myshopify.com — not your custom storefront domain. You can find it in your Shopify admin URL or under Settings → Domains.

Add the Admin API token to Sim

Open Integrations from your workspace sidebar
Search for "Shopify" and open it, then click Add to Sim and choose Add admin API token
Paste the Admin API access token, enter the store domain (e.g. your-store.myshopify.com), and optionally set a display name and description
Click Add admin API token. Sim verifies the token with a scope-free shop query on the store’s GraphQL Admin API — if it fails, you'll see a specific error explaining what went wrong.

The token and store domain are encrypted before being stored.

Use the credential in workflows

Add a Shopify block to your workflow. In the credential dropdown, select the saved Shopify Admin API token. Select it and configure the block as you normally would — the store domain stored with the credential is used automatically.

The block calls your store's Admin API (your-store.myshopify.com/admin/api/...) using the token, with exactly the scopes you granted the app.

Token lifecycle and recovery

A pasted credential must use a non-expiring offline token; Sim does not renew online, expiring offline, or 24-hour client-credentials tokens. A shpat_ prefix alone does not establish the token’s lifetime. See Shopify’s access-token reference.

Tokens are scoped to the app’s installation on a store. Add a separate credential for each store. If an operation fails with access denied, review the app’s scopes and the store’s approval for protected data. Apply the scope change and re-authorize as required; update Sim if the procedure issues a replacement token.

Legacy admin-created custom apps reveal their token only once. If it is lost, uninstall/reinstall or recreate the app to issue a replacement. These procedures invalidate the old token, so plan the interruption and update Sim immediately. Do not apply that one-time UI recovery procedure to a Dev Dashboard app that obtains its token through OAuth.