Difference between admin api access token (starting with shpua, shpat, shpss etc..)

Retired Boards Appdev Graphql Basics And Troubleshooting

Topic summary

Access Token Prefix Types:

Shopify admin API access tokens use different prefixes to indicate the app type:

  • shpat_ - Public apps
  • shpca_ - Custom apps
  • shpss_ - Legacy private apps
  • shpua_ - Apps listed as “undecided” in the Partner Dashboard

Key Details:

The original poster encountered different token prefixes when building a starter app via Shopify CLI (shpua_) versus integrating with a third-party app (shpat_). This formatting convention is documented in Shopify’s April 2020 API changelog regarding access token length increases.

Current Status:

The shpua_ prefix appears specifically on newer apps that haven’t been categorized yet in the Partner Dashboard. The discussion clarified the meaning of various prefixes but remains open for additional context about token differences and security considerations.

Summarized with AI on November 20. AI used: claude-sonnet-4-5-20250929.
1

I created an starter app using shopify cli.

I tried to print session.access_token.

The token started with shpua _…

I was then checking out a 3rd party website which integrates Shopify with their own shopify app. I connected my store to their website by installing their app on my store.

I was able to view the access_token generated by installing their shopify app in my store (their dashboard shows the generated access_token)

It started with shpat _

My question is,

what is the difference between these tokens starting differently (shpat, shpua,…) ?

where can i find more information related to them ?

is this important to consider ?

I cannot find anything explaining the difference between these tokens.

Any suggestions would be helpful.

Thanks in advance,

hkr4274.

2

Hi @hkr4274

The prefix attached to an app’s access token should correspond to the type of app it’s been generated for. The information on this formatting is detailed in our API change log from April 2020.

Hope that helps.

1 Like
3

a static prefix of shpat _ (for public apps), shpca _ (for custom apps), or shppa_ (for legacy private apps).

What is shpua _?

4

Hi again @DarwynnF

Sorry I didn’t clarify for all prefixes. From looking at a couple of my own apps’ access tokens, the *shpua_* prefix is only appearing on my new apps that are still listed as undecided in the partner dashboard.

Hope that helps.

5

Thanks JamesG.