How to Use Shopify OAuth to Generate Access Tokens: A 2025 Developer Guide

Generating a Shopify access token is the first step for any app or integration that needs to call the Shopify Admin API. In 2025, there are two main approaches: the classic Legacy OAuth flow and the newer Dev Dashboard (Admin API access token) method. This guide covers both.

Method 1: Admin API Access Token (Simplest)

If you're building an internal tool, a script, or a private integration for a single store, the Admin API access token is the fastest path.

Go to Shopify Admin → Settings → Apps and sales channels → Develop apps
Click Create an app, give it a name
Under the Configuration tab, select the API scopes you need
Click Install app under the API credentials tab
Click Reveal token once — copy it immediately, it won't be shown again

The token format is shpat_xxxxxxxxxxxxxxxxxxxxxxxx. Use it in API requests via the X-Shopify-Access-Token header.

Method 2: OAuth 2.0 Flow (For Public Apps)

If you're building an app that will be installed by multiple merchants, you need the full OAuth flow. Here's the sequence:

Step 1 — Redirect to Shopify's authorization endpoint

GET https://{shop}.myshopify.com/admin/oauth/authorize
  ?client_id={api_key}
  &scope={scopes}
  &redirect_uri={redirect_uri}
  &state={nonce}

Always generate a random state value and store it server-side to prevent CSRF attacks.

Step 2 — Handle the callback

After the merchant authorises, Shopify redirects to your redirect_uri with a code parameter. Validate the state matches, then exchange the code:

POST https://{shop}.myshopify.com/admin/oauth/access_token
Content-Type: application/json

{
  "client_id": "{api_key}",
  "client_secret": "{api_secret}",
  "code": "{authorization_code}"
}

Step 3 — Store the token

The response contains access_token and scope. Store the token securely — in a database, never in client-side code or version control.

Redirect URI Requirements

Shopify validates the redirect URI against the list you configure in your app settings. For local development, add http://localhost:3000/callback. For production, use your actual domain over HTTPS.

You can use a tool like this one — Shopify Token Generator — to handle the OAuth flow without writing any code, which is useful for quickly generating tokens during development.

Token Scopes in 2025

Shopify has been tightening scope requirements. A few things to note:

Request only the scopes your app actually needs — Shopify's app review process flags over-permissioned apps
Some scopes now require explicit merchant consent during installation
The unauthenticated_* scopes for Storefront API access are separate from Admin API scopes

Security Best Practices

Always validate the HMAC signature on incoming webhook and callback requests
Use short-lived state tokens (expire after 5 minutes) to prevent replay attacks
Store access tokens encrypted at rest
Never log access tokens, even in development
Implement token rotation if your app supports it