FROM CACHE - en_header

Authentication for a "private app"

Shopify Partner
1 0 0


I'm engaged in building an app that's responsible for fetching a list of currently open orders from a single shop to feed to into an external system (this is single-use and will "pull" only so a full-on web stack would be overkill). I've been to my partner portal, created a development shop and generated private API keys.

What do I do with them?

I understand private apps don't authenticate through OAuth, but I'm not able to find any information on excatly how to authenticate using the private keys. All the Authentication links I follow in the documentation wind up talking about OAuth specifically and if they mention the private app process at all they point me back to steps for generating the keys.

Google found me a post on these forums ( that's marked "Outdated" and links to a github repository for a PHP library that's no longer maintained. So I'm leery about any information I find there.

I assume I need to do something like what's described here?

To obtain the access token, send a POST request to https://<shop>/admin/oauth/access_token where shop is the domain of the shop where the application is being installed (e.g. The body of the POST request will contain the API key for the application, the application secret key, as well as the code provided in the original request parameters.

But I'm at a loss as to what I'm supposed to use as "the code provided in the original request parameters." All I have are the key, password, and secret from my private portal. Where do I get this code?



EDIT: After looking over the PHP source at and (I'm C# native but I groked most of it) it looks like I need to make a web request to a URL like: https://{apiKey}:{password} with a json content-type header and I should get back some sort of JSON response? Is that correct?

I've tried making a GET and a POST to this URL and I get a 302 redirect to in both cases. What am I missing?



Replies 4 (4)
265 0 29

Set them in the credentials in the http object before making the call.



Shopify Staff (Retired)
Shopify Staff (Retired)
533 1 107

Hi Lamont,

For a private application for a single shop, you don't need to generate credentials on your partner account, you should generate these credentials in the shop admin.

See this guide:

The endpoint you are requesting should be formatted like this:

Where products.json can be any of the endpoints described in the API Reference.



Jamie | Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit the Shopify Help Center or the Shopify Blog

Shopify Expert
76 0 13

Lamont, in response to your edit - the format "" works in some browsers / HTTP libraries because they support automatic translation of the api_key:password@host format into basic authentication.

If your HTTP library doesn't support this automatically, you'll need to look into how to set basic auth in the HTTP headers.

P.S. If you're already switching from familiar C# to a new language for this project, I'd recommend Ruby which has likely the best Shopify library support & documentation.

Pogodan |
Shopify Partner
80 4 15

I realize this is an old post, but it come up in Google as I searched for how to authenticate a private app with an access token, which is possible and is not included in any of these answers.

In our case, we use C# and ShopifySharp and were looking to create a Webhook and their WebhookService only takes an accessToken as a parameter, not user/pwd. 

You can use a token only and it is the value listed in the Shopify Admin API's Password field that you use as the Token:


Private apps can authenticate with Shopify by including the request headerX-Shopify-Access-Token: {access_token}, where {access_token }is replaced by your private app's Admin API password.

Hope this helps some other Googler 🙂

Chad Richardson
Mozzo Software - Modular Software that grows with you from solopreneur to a 200 person mega team. Why keep outgrowing your Shopify Apps? Start with us, and just use the modules you need, then add more as you grow.