Shopify API connection: OAuth, Custom App, or private token? Clear comparison to choose the right authentication method in 2026.
Typing "shopify connection" into Google returns almost exclusively tutorials for reconnecting to your admin account. The real problem for most developers landing on that page has nothing to do with a forgotten password: they're trying to connect a third-party app to the Shopify API, and they're getting lost between three authentication methods that look nothing alike.
This confusion costs time. A lot of time. This article compares the three ways to connect an app to Shopify, custom app, OAuth public, legacy token, and clearly says which one to use depending on your situation.
The three methods for connecting to the Shopify API
Shopify historically offers multiple paths to gain access to the Admin API. They're not interchangeable, and the official documentation often mixes them across different pages without ever comparing them head-to-head.
The custom app (admin-only application)
This is the recommended method for internal use: an integration built for a single store, with no intention of publishing it on the Shopify App Store. The merchant generates an access token themselves from their admin panel, defining the necessary scopes (read orders, write products, etc.).
No OAuth flow, no redirects, no Shopify review. You generate the token, you use it. It's straightforward.
The OAuth flow (public app)
Necessary if the application needs to work on multiple different stores, typically an app meant to be listed on the Store. The merchant grants access through a consent screen, Shopify redirects to your callback with an authorization code, your server exchanges that code for a token.
It's more heavyweight to set up. But it's the only viable option if you don't control the target store.
The legacy private token
Old method, still present in parts of production code at some clients we've audited. Shopify has been actively pushing toward custom apps for several years. A project still using a "classic" private app deserves to be migrated, it's no longer the platform's recommended path.
The comparison table
| Criterion | Custom App | OAuth (Public App) | Legacy token |
|---|---|---|---|
| Intended use | Single store | Multi-store, App Store | Deprecated |
| Setup | Simple, a few minutes | Complex, full flow to code | Simple but obsolete |
| Shopify review | Not required | Required if published to Store | Not required |
| Token rotation | Manual | Handled by OAuth flow | Manual |
| Recommended in 2026 | Yes | Yes, if multi-merchant | No |
The most common error we see with our clients
Most teams choose their authentication method before knowing how many stores their app will need to serve. Result: they go all-in on a complete OAuth flow, callback webhook, state management, secure token storage per merchant, for a project that will only ever serve a single internal store.
That's three to four times more code than necessary.
With one e-commerce client we worked with, the existing integration was still running on a legacy token from several years back. The scopes were way too broad, full access to orders and customers for a tool that only needed to read inventory. We migrated to a custom app with precise scopes. Immediate result: reduced attack surface, and no more security alerts on that integration at subsequent audits.
One honest limitation to know: the custom app only works on the store where it was created. If your client changes their Shopify plan or migrates to a new store, you need to regenerate the token. It's not automatic.
Securing your connection once you have the token
Choosing the right method isn't enough. The token itself must be treated as a critical secret, never committed to a repo, never logged in plaintext.
Three practices really reduce the risk:
- Store the token in a secrets manager (encrypted environment variables, dedicated vault), never in source code.
- Limit scopes to the bare minimum from the moment you create the app, rather than checking everything "just in case".
- Set up regular rotation, even if manual, rather than keeping the same token for years.
And if your team has fewer than three developers on the Shopify project, the custom app is almost always the right default choice. The full OAuth flow only makes sense if multiple independent merchants need to install your app someday.
What you need to remember
Three methods exist, but one question determines the right choice: will your app serve one store or multiple? For a single store, the custom app is enough and takes a few minutes to set up. For multi-merchant, go OAuth, despite its complexity.
The legacy token has no place in a new project in 2026.
If your current Shopify integration still relies on an old authentication method, or if you're unsure about the architecture to adopt for a new app, the fstck team can audit your current setup and propose a clean migration. We've already written on similar architecture topics in our guide to creating an MCP server, where the logic of managing access to external tools follows very similar principles.
Frequently asked questions
How do I get an Admin API access token without going through the full OAuth flow?
By creating a custom app directly from the merchant's Shopify admin interface. The token is generated immediately after you define the necessary scopes, with no redirect or consent screen.
Why does my Shopify token return a 401 error after several months of use?
The most common causes are manual revocation of the token by the merchant, a scope change on the app, or an uninstall followed by a reinstall that generates a new token. First, check the status of the app in the affected merchant's Shopify admin.
What's the difference between a custom app and a legacy private app on Shopify?
The custom app is the currently recommended method by Shopify for single-store use, with finer scope management. The term "private app" referred to the old system, now deprecated in favor of custom apps.
Do I need an OAuth flow to connect a single Shopify store to an internal tool?
No. OAuth only adds value if your application needs to be installed by multiple independent merchants, typically for publication on the Shopify App Store. For single-store internal use, the custom app is faster and sufficient.
Can the scopes of a Shopify custom app be changed after creation?
Yes, but any scope change typically requires regenerating the access token. That's exactly the opportunity to verify that the granted permissions still match the strict needs of your integration.
