Only the store owner can view, create, change or revoke these tokens. Open Settings > API Tokens in Store Admin or the mobile app.
Connect a trusted integration to your store's admin data. Each token has its own permissions. Grant only the access the integration needs. The token count shows the slots in use and the limit for your store.
Create a token
Select Create token, enter a descriptive name, select at least one permission, and choose an API version and expiry. Write access also selects the corresponding read access. Review your choices, then create the token.
Copy the full token immediately and save it securely. It is shown only in this session and cannot be retrieved later. Show and Hide change its visibility; Done removes it from the page. Keep tokens out of URLs, public files and messages to people who do not need access.
Find and change a token
Search by name and use the page controls to browse results. Open a token to review its permissions, API version, expiry and last use. The short prefix identifies the token; it is not the full credential. Never means there is no recorded use or no expiry, as labeled.
Change permissions and save. Removing a permission stops the integration from performing the corresponding action. Adding a permission expands its access. Write access includes read access. Leaving with unsaved edits offers a choice to discard them or keep editing.
API version and expiry cannot be edited after creation. Create a replacement to change either, update the integration, test it, and revoke the old token. Expired tokens cannot be used; revoke them to free their slots.
Rotate a token
Rotation replaces the secret for the same token and immediately invalidates the old secret. It keeps its permissions, API version and expiry; it does not extend an expired token. Confirm the warning, copy the replacement secret and update every integration using the old one. If you need overlap while switching, create a separate token instead.
Revoke access
Open a token and select Revoke, or select tokens on the current list page and choose Revoke. Review the confirmation before continuing. Revocation cannot be undone and integrations using the selected tokens lose access. Other tokens are unchanged. Clearing a search or changing pages clears the selected rows.
Recover from an error
If loading fails, select Retry. A failed action shows an error and keeps your form or confirmation available. If you lose a newly issued secret, create another token and revoke the unused one. Check the selected permissions, token expiry and API version if an integration stops working.