How to Connect Shopify to API2Cart?

To connect Shopify store to API2Cart you need to specify the following credentials:

Required credentials:

1. shopify_access_token - for connection via Custom app
2. shopify_shared_secret - is needed to work with Live Shipping Rates or Webhooks
3. shopify_client_id - is needed to work with shopify_access_token with an expiration time

Starting from 01.01.2026, creating custom apps in Shopify will no longer be available (apps created before this date will continue to work as before).

App creation will be available through the Developer Dashboard.

To create a new app, log in to the Developer Dashboard and click Create App.

Enter the app name in the App Name field.

Select the required scopes and fill in the Redirect URLs field (if the app will use the Authorization Code Flow for authentication: Authorization Code Flow).

The required scopes for API methods are listed in the table below.

After that, the new app will be available on the dashboard.

The app can be installed on a store directly by clicking the Install button.

Then select the desired store and confirm the app installation.

You can also choose distribution for the app.

There are two types of distribution:

• Public distribution
• Custom distribution

If you choose the Custom distribution type, you need to generate an installation link (multi-store installation is also possible). This link allows the app to be installed by store owners, who will confirm the installation.

Apps installed this way will receive offline tokens with an expiration time. To get an access_token, execute the request:

curl --location 'https://{store_url}.myshopify.com/admin/oauth/access_token' \
--header 'Content-Type: application/json' \
--data '{
    "grant_type": "client_credentials",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
}'

Replace client_id and client_secret with values from the app settings.

The response will include access_token, list of scopes, and token expiration time.

Stores with this offline token type must be added to API2Cart with optional parameters shopify_client_id and shopify_shared_secret. This allows token refresh on our side. Without these parameters, the offline token will eventually cause authorization errors and API methods will fail.

To generate an online token with unlimited duration, the app must be authorized using the Authorization Code Flow. Build the authorization URL:

https://{store_url}/admin/oauth/authorize?client_id={client_id}&scope={scopes}&redirect_uri={redirect_uri}&state={nonce}

Where:

• store_url – store URL
• client_id – app client ID
• scopes – scopes used by the app
• redirect_uri – redirect URL specified during app creation
• nonce – random value to unify the authorization request

Note: You can also add grant_options[]=per-user to generate a token with limited duration.

After visiting the authorization link, the store owner will approve app access to the scopes, and a code parameter will be sent to the redirect URL. Use this code in the request:

curl --location 'https://a2c-demo.myshopify.com/admin/oauth/access_token' \
--header 'Content-Type: application/json' \
--data '{
    "code": "{code}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
}'

Where code is the code received at the redirect URL, and client_id / client_secret are the app credentials. This token will have no expiration and will only become invalid if the store owner uninstalls the app.

The obtained access_token can be used as the shopify_access_token parameter to add a store to API2Cart.

Note: For shopify_shared_secret, used to verify webhook signatures and live shipping rates, use the app client secret.

Table of Required Shopify App Scopes for our API Methods: