Private authentication

A private Shopify application can interact with the Shopify API on behalf of a single store. To authenticate with Shopify using a private application, you'll need to generate the credentials from the Shopify admin and provide these credentials in your request to Shopify.

Generate credentials from the Shopify admin

Before you can authenticate a private application to Shopify, you need to generate the required credentials from the Shopify admin of the store that you want to connect with your application. If you don't have a Shopify store, then you can log in to your Partner dashboard and click Development stores to provision a test store.

To generate the required credentials:

  1. From your Shopify admin, go to Apps.

  2. Click Manage private apps.

  3. Click Create new private app.

  4. In the Description section, enter a Private app name.

  5. In the Permissions section, select the areas of your store that you want the app to be able to access.

  6. When you're done, click Save. The API key and password for your application are now displayed on screen.


Treat the API key and password like you would any other password, since whoever has access to these credentials has full API access to the store.

After you have the required credentials, you can perform authenticated requests.

Perform authenticated requests

Private applications authenticate with Shopify through basic HTTP authorization, where the API key of the application is the username, and the Password is the password. You can generate these credentials from the Shopify admin of the store that you want to connect with your application.

Some HTTP clients support basic authentication by prepending username:password@ to the hostname in the URL. For example:

GET 4478eb7ac138a136852babd861956c19:3e5a6edec71eab039422c6444d02659d@

If your HTTP client doesn't support basic authentication using this method, then you can provide the credentials in the Authorization header field instead:

  1. Join the API key and password with a single colon (:).

  2. Encode the resulting string in base64 representation.

  3. Prepend the base64-encoded string with Basic and a space:

    Authorization: Basic NDQ3OGViN2FjMTM4YTEzNjg1MmJhYmQ4NjE5NTZjMTk6M2U1YTZlZGVjNzFlYWIwMzk0MjJjNjQ0NGQwMjY1OWQ=