{'errors': '[API] Invalid API key or access token (unrecognized login or wrong password)'}

Retired Boards Appdev Authentication

Topic summary

Main issue: A request to the Shopify Admin REST API to list products fails with an authentication error: {‘errors’: ‘[API] Invalid API key or access token (unrecognized login or wrong password)’}. The caller embedded a private app’s API key and password directly in the URL.

Cause and guidance: Shopify expects authentication via an access token sent in HTTP headers, not API key/secret in the URL. Specifically, include the store’s access token (e.g., X-Shopify-Access-Token) per the REST Admin API docs.

Suggested actions:

  • Send the access token in request headers following the Shopify authentication guide.
  • Alternatively, use the official Shopify Python API client, which manages authentication.

Clarifications: An access token is the credential issued to the app for store access. HTTP headers are metadata fields in requests used to transmit auth data.

Status: No resolution confirmed yet; awaiting user update.

Summarized with AI on December 21. AI used: gpt-5.
2

Hi Alex,

are you using python? To authenticate, you need to include the access token in the headers, like it’s described here: REST Admin API reference (shopify.dev).

Alternatively, you can use the python api client: Shopify/shopify_python_api: ShopifyAPI library allows Python developers to programmatically access the admin section of stores (github.com)

All the best,

Michael