1. Shopify app

This is the first half of the setup. It produces three things you'll need later: a Client ID, a Client secret, and an App Proxy pointed at your API.

Why a Shopify app at all?

You're not building an app. You need one anyway, because of where the App Proxy setting lives.

An App Proxy tells Shopify: "when someone requests your-store.com/apps/admin-api/…, forward it to this other server, and sign the request so that server knows it really came from us."

That setting is configured on an app — there is nowhere else to put it. A theme cannot declare one. So you create an app whose only job is to carry that setting and to own the API credentials.

It is never installed from the App Store, never listed publicly, and has no interface. It exists so two settings have somewhere to live.

What you get from it

Before you start

You need to be able to create an app in the same Shopify organization as your store. If the app and the store are in different organizations the token exchange fails with shop_not_permitted, and nothing you change later will fix it — it has to be the same org.

1. Create the app

The theme ships a ready-made config at shopify-app/. It is four files, and the only one you edit is the TOML.

cd shopify-app
cp shopify.app.toml.example shopify.app.toml
npx shopify app init

shopify app init asks two things:

• Which organization — pick the one your store belongs to.
• Create a new app, or link an existing one — new, unless you already have an app you want to attach the proxy to.

Give it a name you'll recognise in the dashboard, like Store API. The name is never shown to shoppers.

When it finishes, shopify.app.toml has a client_id written into it. That's the first of your three things.

2. Find the Client secret

The CLI writes the client id into the file but never the secret — secrets don't belong in a file that gets committed.

Get it from the Dev Dashboard: your app → Settings → Client credentials. You'll see the Client ID (matching your TOML) and the Client secret next to it.

Copy the secret somewhere safe for a few minutes — you'll paste it into Netlify shortly. Treat it like a password: anyone holding it can mint Admin API tokens for your store.

There is no "Admin API access token" to find, and this is the part that confuses everyone. Shopify stopped issuing static shpat_… tokens for new apps, and you can no longer create a custom app from the Shopify admin. If you're looking for a token field in the dashboard, it isn't there any more.

The client id and secret are traded for a short-lived token automatically — see Admin operations.

3. Point the proxy at your API — later

You need your Netlify URL for this, and you don't have one yet. Do Netlify next, then come back to Connect them.

If you'd rather see the shape now, this is what you'll be adding:

1[app_proxy]
2url = "https://your-site.netlify.app"
3prefix = "apps"
4subpath = "admin-api"

Which produces:

https://your-store.com/apps/admin-api/admin.gql
        └──────┬──────┘ └─┬─┘ └───┬────┘ └───┬───┘
          your store    prefix  subpath    route

prefix must be one of apps, a, community or tools — Shopify only proxies those four. subpath is yours to choose.

What the four files are

There is no application code. Nothing runs. The app is configuration.

Next

Deploy the API so you have a URL → Netlify