$npx -y skills add jezweb/claude-skills --skill shopify-setupSet up Shopify CLI auth and Admin API access for a store. Install CLI, authenticate, create custom app, store access token, verify. Use whenever the user wants to connect to a Shopify store, set up Shopify API access, install Shopify CLI, or troubleshoot Shopify auth / Admin API
| 1 | # Shopify Setup |
| 2 | |
| 3 | Set up working Shopify CLI authentication and Admin API access for a store. Produces a verified API connection ready for product and content management. |
| 4 | |
| 5 | ## Workflow |
| 6 | |
| 7 | ### Step 1: Check Prerequisites |
| 8 | |
| 9 | Verify the Shopify CLI is installed: |
| 10 | |
| 11 | ```bash |
| 12 | shopify version |
| 13 | ``` |
| 14 | |
| 15 | If not installed: |
| 16 | |
| 17 | ```bash |
| 18 | npm install -g @shopify/cli |
| 19 | ``` |
| 20 | |
| 21 | ### Step 2: Authenticate with the Store |
| 22 | |
| 23 | ```bash |
| 24 | shopify auth login --store mystore.myshopify.com |
| 25 | ``` |
| 26 | |
| 27 | This opens a browser for OAuth. The user must be a store owner or staff member with appropriate permissions. |
| 28 | |
| 29 | After login, verify: |
| 30 | |
| 31 | ```bash |
| 32 | shopify store info |
| 33 | ``` |
| 34 | |
| 35 | ### Step 3: Create a Custom App for API Access |
| 36 | |
| 37 | Custom apps provide stable Admin API access tokens (unlike CLI session tokens which expire). |
| 38 | |
| 39 | **Check if an app already exists**: Ask the user if they have a custom app set up. If yes, skip to Step 4. |
| 40 | |
| 41 | **If no custom app exists**, guide the user through creation via browser: |
| 42 | |
| 43 | 1. Navigate to `https://{store}.myshopify.com/admin/settings/apps/development` |
| 44 | 2. Click **Create an app** |
| 45 | 3. Name it (e.g. "Claude Code Integration") |
| 46 | 4. Click **Configure Admin API scopes** |
| 47 | 5. Enable these scopes (see `references/api-scopes.md` for details): |
| 48 | - `read_products`, `write_products` |
| 49 | - `read_content`, `write_content` |
| 50 | - `read_product_listings` |
| 51 | - `read_inventory`, `write_inventory` |
| 52 | - `read_files`, `write_files` |
| 53 | 6. Click **Save** then **Install app** |
| 54 | 7. Copy the **Admin API access token** (shown only once) |
| 55 | |
| 56 | Use browser automation (Chrome MCP or playwright-cli) if the user prefers assistance navigating the admin. |
| 57 | |
| 58 | ### Step 4: Store the Access Token |
| 59 | |
| 60 | Store the token securely. Never commit it to git. |
| 61 | |
| 62 | **For project use** — create `.dev.vars`: |
| 63 | |
| 64 | ``` |
| 65 | SHOPIFY_STORE=mystore.myshopify.com |
| 66 | SHOPIFY_ACCESS_TOKEN=shpat_xxxxxxxxxxxxxxxxxxxxx |
| 67 | ``` |
| 68 | |
| 69 | Ensure `.dev.vars` is in `.gitignore`. |
| 70 | |
| 71 | **For cross-project use** — store in your preferred secrets manager (environment variable, 1Password CLI, etc.). |
| 72 | |
| 73 | ### Step 5: Verify API Access |
| 74 | |
| 75 | Test the connection with a simple GraphQL query: |
| 76 | |
| 77 | ```bash |
| 78 | curl -s https://{store}.myshopify.com/admin/api/2025-01/graphql.json \ |
| 79 | -H "Content-Type: application/json" \ |
| 80 | -H "X-Shopify-Access-Token: {token}" \ |
| 81 | -d '{"query": "{ shop { name primaryDomain { url } } }"}' | jq . |
| 82 | ``` |
| 83 | |
| 84 | Expected response includes the shop name and domain. If you get a 401, the token is invalid or expired — recreate the app. |
| 85 | |
| 86 | ### Step 6: Save Store Config |
| 87 | |
| 88 | Create a `shopify.config.json` in the project root for other skills to reference: |
| 89 | |
| 90 | ```json |
| 91 | { |
| 92 | "store": "mystore.myshopify.com", |
| 93 | "apiVersion": "2025-01", |
| 94 | "tokenSource": ".dev.vars" |
| 95 | } |
| 96 | ``` |
| 97 | |
| 98 | --- |
| 99 | |
| 100 | ## Critical Patterns |
| 101 | |
| 102 | ### API Version |
| 103 | |
| 104 | Always specify an explicit API version (e.g. `2025-01`). Using `unstable` in production will break without warning. Shopify retires API versions quarterly. |
| 105 | |
| 106 | ### Token Types |
| 107 | |
| 108 | | Token | Format | Use | |
| 109 | |-------|--------|-----| |
| 110 | | Admin API access token | `shpat_*` | Custom apps — stable, long-lived | |
| 111 | | CLI session token | Short-lived | Shopify CLI commands only | |
| 112 | | Storefront API token | `shpca_*` | Public storefront queries | |
| 113 | |
| 114 | This skill sets up **Admin API access tokens** — the right choice for product and content management. |
| 115 | |
| 116 | ### Rate Limits |
| 117 | |
| 118 | Shopify uses a leaky bucket rate limiter: |
| 119 | - **REST**: 40 requests/second burst, 2/second sustained |
| 120 | - **GraphQL**: 1,000 cost points per second, max 2,000 points per query |
| 121 | |
| 122 | For bulk operations, use the `bulkOperationRunQuery` mutation instead of looping. |
| 123 | |
| 124 | --- |
| 125 | |
| 126 | ## Reference Files |
| 127 | |
| 128 | - `references/api-scopes.md` — Admin API scopes needed for product and content management |