Connection guide

Connect Shopify safely to an AI agent

What to do when Shopify sign-in is blocked in a cloud agent browser.

Do not work around the login screen

Shopify may block sign-in from a cloud agent browser. Do not keep retrying, share a password or one-time code, or ask the agent to bypass bot protection.

Choose a file handoff when the task does not need live store data. Use a controlled API connection only when the setup must read or draft changes against the current store.

Choose the safest access method

Most audits, rewrites, and one-time reviews do not need a live connection.

  • No live access: export a Shopify CSV, upload the relevant report, paste a storefront URL, or provide screenshots.
  • Live access required: use a secure connector, such as a server-side MCP service or plugin, to connect to the Shopify Admin API.
  • If the secure connector is unavailable, stop and use the file handoff. Do not fall back to sharing credentials in chat.

Create the Shopify app in Dev Dashboard

For a new app, use Shopify's Dev Dashboard. Create the app, give it only the Admin API permissions required by the setup, release that version, and install it on the store.

Copy the Client ID and Client secret into the connector's server-side secret store. Do not put either value in client-side code, a setup prompt, a repository, or a generated page.

The connector exchanges those credentials for an Admin API access token. Shopify's client-credentials access token lasts about 24 hours, so the connector must request a new token automatically instead of asking you to maintain a pasted token.

For Grok Bot

Connect Shopify through a secure connector, such as an MCP server or plugin. The connector stores Shopify credentials and allows only the store actions this setup needs.

Enter a secret only through a supported secure secret request or protected plugin variable supplied by that connector. If Grok Bot presents only an ordinary chat box, do not send the secret.

Remember that Grok Bot cloud computers can be shared across your bot roster. Do not save Shopify credentials in files, shell history, browser notes, or prompt text on that computer.

Start read-only and keep approvals

Give the app only the Shopify permissions needed to complete the setup. A permission to change data already includes permission to read the same data, so do not request both without a specific reason.

  • Start with read-only access for products, orders, inventory, customers, themes, or analytics only when the setup uses that data.
  • Add write access only for a named operation that you have decided to automate.
  • Keep publishing, refunds, fulfillment, inventory adjustments, price changes, discounts, and customer sends behind explicit approval.
  • Use a dedicated app for this connection so its access can be reviewed and revoked without disturbing other integrations.

Remove access when the work is done

Disable or uninstall the app when the connection is no longer needed, remove the connector's stored credentials, and review any logs retained by the connector. Rotate the Client secret immediately if it was ever exposed outside the secure flow.

Official sources

Last verified: August 25, 2026