Private apps

A private Shopify app can interact with the Shopify API on behalf of a single store. To authenticate with Shopify using a private app, you'll need to generate the credentials from the Shopify admin and provide these credentials in your request to Shopify.

Generate credentials from the Shopify admin

Before you can authenticate a private app to Shopify, you'll need to generate the required credentials from the Shopify admin of the store that you want to connect with your application. If you don't have a Shopify store, then you can log in to your Partner dashboard and click Development stores to create a test store.

After you've provisioned a test store, log in and then generate the required credentials from the test store admin:

  1. From your Shopify admin, go to Apps.

  2. Click Manage private apps, near the bottom of the page.

  3. Click Create a new private app.

  4. In the App details section, enter a name for the private app and a contact email address.

    Shopify uses the email address to contact the developer if there is an issue with the private app, such as when an API change might break it.

  5. In the Admin API section, select the areas of your store that you want the app to be able to access.

  6. If you want to use the Storefront API, then select Allow this app to access your storefront data using the Storefront API.

    1. In the Storefront API permissions section, select which types of data you want to expose to the app.

    Four permissions are selected by default: Read products and collections, Read and modify customers, Read and modify checkouts, and Read blogs and articles.

  7. Click Save.

You'll see your API key and password in the Admin API section. You can use these credentials to make authenticated requests to the Shopify store that uses your application.

If you allowed the app to access your storefront data, then you'll see a Storefront access token in the Storefront API section.

Make authenticated requests

Private apps authenticate with Shopify through basic HTTP authorization, where the API key of the app is the username, and the Password is the password. You can generate these credentials from the Shopify admin of the store that you want to connect with your app.

Some HTTP clients support basic authentication by prepending username:password@ to the hostname in the URL. For example:


If your HTTP client doesn't support basic authentication using this method, then you can provide the credentials in the Authorization header field instead:

  1. Join the API key and password with a single colon (:).

  2. Encode the resulting string in base64 representation.

  3. Prepend the base64-encoded string with Basic and a space:

    Authorization: Basic NDQ3OGViN2FjMTM4YTEzNjg1MmJhYmQ4NjE5NTZjMTk6M2U1YTZlZGVjNzFlYWIwMzk0MjJjNjQ0NGQwMjY1OWQ=

Sign up for a Partner account to get started.

Sign up