How to Get Your Shopify Admin API Access Token and Connect Shopify to OneSpace

Connecting Shopify to an AI platform can unlock powerful workflows across your products, orders, customers, inventory, and sales data.

The confusing part is that Shopify does not simply display an Admin API token for newer apps created through the Dev Dashboard. Instead, Shopify gives you a Client ID and Client Secret, which must be exchanged for an Admin API access token.

This guide walks through the entire process, including the small store-name mistake that causes many Shopify connections to fail.

What You Will Need

Before starting, make sure you have:

• A Shopify store you own
• Access to Shopify’s Dev Dashboard
• A Shopify app created for your store
• The ability to open Terminal on your computer
• A OneSpace account

This method uses Shopify’s client credentials grant. It is intended for trusted integrations where the app and store are owned by the same organization.

Step 1: Create a Shopify App

Open Shopify’s Dev Dashboard and select Create app.

Choose Start from Dev Dashboard, enter a name for your app, and create it. Shopify’s Dev Dashboard is designed for integrations that connect external systems to a Shopify store.

You can name the app something simple, such as:

OneSpace Integration

Step 2: Create and Release an App Version

Inside your new app, open the Versions tab.

Create a version and configure the API permissions, also known as access scopes, that OneSpace will need.

For example:

read_products
read_orders
read_customers
read_inventory

Only select the permissions you actually plan to use. Shopify requires apps to request specific scopes before they can access store data. For example:

• To check your sales or orders, enable read_orders
• To view products, enable read_products
• To update products, enable write_products
• To view inventory, enable the appropriate inventory scope

After configuring the app, select Release. Shopify requires an app to have at least one released version before it can be installed on a store.

Step 3: Install the App on Your Store

Return to the app’s Home page in the Dev Dashboard.

Scroll down and select:

Install app

Choose the correct Shopify store and approve the requested permissions.

The app must be installed before Shopify will issue an access token for that store.

Step 4: Copy Your Client ID and Client Secret

Open your Shopify app and go to:

Settings

Copy the following credentials:

Client ID
Client Secret

Shopify uses these credentials to identify and authenticate your app when it requests an API access token.

Your Client Secret is private. Never place it in frontend code, publish it on GitHub, or include it in a screenshot. Shopify recommends rotating the secret immediately if it becomes exposed.

Step 5: Find Your Shopify Store Name

Your permanent Shopify domain should look similar to this:

my-store.myshopify.com

For the connection process, the store name is only the part before .myshopify.com.

Correct

my-store

Incorrect

my-store.myshopify.com

Also incorrect

https://my-store.myshopify.com

This is one of the easiest mistakes to make. Shopify’s token endpoint expects {shop} to represent the store-name portion before .myshopify.com.

Step 6: Store Your Credentials in a .env File

Open Terminal and navigate to your project folder.

Create a .env file:

nano .env

Add the following:

SHOPIFY_SHOP=your-store-name
SHOPIFY_CLIENT_ID=your-client-id
SHOPIFY_CLIENT_SECRET=your-client-secret

For example:

SHOPIFY_SHOP=sixteen-studios
SHOPIFY_CLIENT_ID=your-client-id
SHOPIFY_CLIENT_SECRET=your-client-secret

Do not include $ symbols before the values.

Do not write:

SHOPIFY_SHOP=$sixteen-studios

Shopify recommends storing credentials in a .env file and excluding that file from version control.

Add this line to your .gitignore file:

.env

Save the file in Nano

Press:

Control + O
Enter
Control + X

Step 7: Load the Credentials

Run these commands one at a time:

set -a
source .env
set +a

Check that the store name loaded correctly:

echo "$SHOPIFY_SHOP"

It should return something like:

sixteen-studios

It should not return the complete .myshopify.com URL.

You can also verify your Client ID:

echo "$SHOPIFY_CLIENT_ID"

Do not print your Client Secret.

Step 8: Generate the Shopify Admin API Access Token

Run the following request in Terminal:

curl -sS -X POST \
"https://${SHOPIFY_SHOP}.myshopify.com/admin/oauth/access_token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
--data-urlencode "grant_type=client_credentials" \
--data-urlencode "client_id=${SHOPIFY_CLIENT_ID}" \
--data-urlencode "client_secret=${SHOPIFY_CLIENT_SECRET}"

Shopify’s token endpoint accepts the Client ID, Client Secret, and client_credentials grant type.

A successful response should look similar to:

{
  "access_token": "shpat_xxxxxxxxxxxxxxxxx",
  "scope": "read_orders,read_products",
  "expires_in": 86399
}

The value beginning with:

shpat_

is your Shopify Admin API access token. Shopify documents this token as the credential placed in the X-Shopify-Access-Token header for authenticated API requests.

Do not confuse it with your Client Secret.

Admin API access token: shpat_...
Client Secret: shpss_...

Step 9: Connect Shopify to OneSpace

Open OneSpace, go to Integrations, and select Shopify.

Enter the requested Shopify credentials.

The most important field is the Shopify store name.

For a store with this domain:

sixteen-studios.myshopify.com

enter:

sixteen-studios

Do not enter the full domain unless the connection screen specifically requests a domain or URL.

Depending on the fields displayed, you may be asked for:

Shop Name
Client ID
Client Secret
Admin API Access Token

Paste each value into its matching field and complete the connection.

Once connected, you can ask OneSpace to perform approved actions based on your app’s permissions, such as:

Check how many Shopify orders I have

Show my latest Shopify sales

List my best-selling products

Check which products are low in stock

OneSpace can only access the Shopify information allowed by the scopes you selected when configuring the app.

Important: Your Token Expires

Access tokens generated through the client credentials grant expire after 86,399 seconds, which is approximately 24 hours. A fresh token can be obtained by repeating the same token request with your Client ID and Client Secret.

Keep the Client ID and Client Secret secure because they are used to generate new access tokens.

Common Shopify Connection Errors

“Store unavailable”

This usually means the store name is formatted incorrectly.

Use:

my-store

Not:

my-store.myshopify.com

If your code already adds .myshopify.com, entering the full domain can accidentally create:

sixteen-studios.myshopify.com.myshopify.com

“Could not find Shopify API application”

Your Client ID may be incorrect or missing a character.

Check it with:

echo "$SHOPIFY_CLIENT_ID"

Compare the entire value with the Client ID shown in Shopify’s Dev Dashboard.

“App not installed”

Return to your app’s Home page in Shopify’s Dev Dashboard and install the app on the store you are trying to connect. Shopify requires an installation for each store where the app will request access. (Shopify)

“Invalid API key or access token”

Check that:

• You entered the shpat_ access token
• You did not enter the shpss_ Client Secret in the token field
• The token has not expired
• The app is still installed
• The app has the required access scopes

An entire HTML page appears in Terminal

This normally means the request went to the wrong store address instead of the correct OAuth endpoint.

Confirm that:

echo "$SHOPIFY_SHOP"

returns only the store name.

OneSpace connects but cannot read orders

The Shopify app may not have the required read_orders scope.

Create and release an updated app version with the correct permissions. Shopify notes that newly added scopes are not automatically applied to existing installations and might need to be approved again. (Shopify)

Security Checklist

Before finishing, confirm that:

• Your .env file is included in .gitignore
• Your Client Secret has not been posted publicly
• Your Admin API token has not been shared
• You selected only the scopes OneSpace needs
• You rotated any credentials that were accidentally exposed

Final Result

Once the Shopify connection is active, OneSpace can securely work with the store data your app has permission to access.

The complete process is:

Create the Shopify app
Configure its scopes
Release an app version
Install it on your store
Copy the Client ID and Client Secret
Generate the shpat_ access token
Enter only the Shopify store name in OneSpace
Complete the connection

The biggest detail to remember is simple:

When OneSpace asks for your Shopify store name, enter the part before .myshopify.com.

For example:

my-store

Not:

my-store.myshopify.com

Once connected, you can manage and understand your Shopify business through natural-language requests inside OneSpace.