---
title: Shopify API authentication
description: >-
  How authentication works across Shopify's APIs, the difference between
  authenticating an app and authenticating a buyer, and which token and header
  each API uses.
source_url:
  html: 'https://shopify.dev/docs/api/usage/authentication'
  md: 'https://shopify.dev/docs/api/usage/authentication.md'
---

# Shopify API authentication

To call a Shopify API, your code sends an access token in a request header to authenticate the identity that token represents (your app or a buyer) and authorize what that identity can access. How you obtain the token and which header carries it [vary by API](#authentication-by-api).

This page explains the shared model behind Shopify API authentication: how a request is authenticated, and where to go to set it up for each API.

***

## How it works

Every authenticated Shopify API request follows the same shape:

1. Your code obtains an access token scoped to the permissions it needs.
2. Your code includes the token in a request header.
3. Shopify checks the token on each request and returns the data the token is scoped to, or an error if the token is missing, invalid, or lacks the required [access scope](https://shopify.dev/docs/api/usage/access-scopes).

Authentication proves which identity is making a request, and authorization determines what that identity is allowed to do. The access token does both: it identifies your app or a buyer, and its access scopes determine what it can access.

Some flows authenticate a user first. For example, embedded apps validate an [ID token](https://shopify.dev/docs/apps/build/authentication-authorization/id-tokens), then exchange it for an access token.

***

## Authentication by API

Which token you use depends on whose data you're working with. Most Shopify APIs, including the [GraphQL Admin API](https://shopify.dev/docs/api/admin-graphql), [Storefront API](https://shopify.dev/docs/api/storefront), and [Partner API](https://shopify.dev/docs/api/partner), authenticate your app acting on behalf of a merchant or organization. The token represents your app and the access a merchant granted it.

The [Customer Account API](https://shopify.dev/docs/api/customer) is the exception. It authenticates a buyer accessing their own account data, such as their orders and addresses. After the buyer signs in and consents, your app receives an access token scoped to that buyer and calls the API on their behalf. For how this flow works, see [Customer Account API authentication](https://shopify.dev/docs/api/customer#authentication).

The following table shows what each API authenticates, how you get the token, and the header it uses:

| API | Authenticates | How you get the token | Header |
| - | - | - | - |
| [GraphQL Admin API](https://shopify.dev/docs/api/admin-graphql) | Your app, on behalf of a merchant | OAuth, usually [token exchange](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens#token-exchange-grant) | `X-Shopify-Access-Token` |
| [Storefront API](https://shopify.dev/docs/api/storefront) | Your app (public or private) | Create [public or private tokens](https://shopify.dev/docs/api/storefront#authentication), or go [tokenless](https://shopify.dev/docs/api/storefront#tokenless-access) for basic data | `X-Shopify-Storefront-Access-Token` or `Shopify-Storefront-Private-Token` |
| [Partner API](https://shopify.dev/docs/api/partner) | Your app, scoped to your Partner organization | Create a [client token](https://shopify.dev/docs/api/partner#authentication) in the Partner Dashboard | `X-Shopify-Access-Token` |
| [Customer Account API](https://shopify.dev/docs/api/customer) | A buyer, on their own behalf | Buyer signs in with [OAuth 2.0 and PKCE](https://shopify.dev/docs/api/customer#authentication) | `Authorization` |

The table covers the most commonly used APIs. For a complete list, see the [Shopify API reference](https://shopify.dev/docs/api).

***

## Next steps

Set up authentication for:

* The [GraphQL Admin API](https://shopify.dev/docs/apps/build/authentication-authorization) to read and write store data, including products, orders, customers, and inventory.
* The [Storefront API](https://shopify.dev/docs/api/storefront#authentication) to build buyer-facing experiences such as product browsing, cart, and checkout.
* The [Customer Account API](https://shopify.dev/docs/api/customer#authentication) to let buyers access their own account data, such as orders and addresses.

Learn more:

* Learn how [access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens) work, including the token types, the GraphQL Admin API's OAuth grants and endpoints, and how tokens expire and refresh.
* Learn what [ID tokens](https://shopify.dev/docs/apps/build/authentication-authorization/id-tokens) are, the claims your app validates, and how they're exchanged for access tokens.
* Understand the [access scopes](https://shopify.dev/docs/api/usage/access-scopes) you request and what each one grants.
* Find the [response and error codes](https://shopify.dev/docs/api/usage/response-codes) Shopify returns, including authentication errors.

***