Issue with Shopify Access Token Using Client Credentials

Retired Boards Appdev Authentication
,
1

I’m developing a Shopify app, alongside a third-party app, both of which communicate with the Shopify Admin REST API.

Previously, I was using ‘client_credentials’ to obtain the access token for the third-party app, and everything worked fine. However, after developing and installing the Shopify app on one of the stores, the ‘client_credentials’ flow stopped working.

Here are the scopes defined in the Shopify app:

read_products, read_assigned_fulfillment_orders, read_merchant_managed_fulfillment_orders, 
read_orders, read_returns, read_third_party_fulfillment_orders, write_assigned_fulfillment_orders, 
write_customers, write_fulfillments, write_merchant_managed_fulfillment_orders, write_orders, 
write_products, write_returns, write_third_party_fulfillment_orders

Here is the client_credentials access token request:

POST https://{shop}.myshopify.com/admin/oauth/access_token
Headers: {content-type: 'application/x-www-form-urlencoded'} 
Payload: { 
  client_id: app_client_id, 
  client_secret: app_client_secret, 
  grant_type: client_credentials
}

Response:

{ 
"error": "shop_not_permitted",
"error_description": "Client credentials cannot be performed on this shop."
}

Has anyone experienced a similar issue? Any insights or solutions would be appreciated!

2

Hi!

Today I received this very error when trying to request an access token from a customers shop. The same app client credentials let me successfully request an access token from a dev shop I created to try to understand the issue.

How did you fix your problem back then?

Thanks!

David

3

I ran into the same error and eventually figured out what was wrong. If you’re using a custom app on a paid store (not a dev store), you can’t rely on the client credentials flow. You have to use token exchange for embedded apps, or authorization code grant for backend apps, exactly as described in the official docs:

The client credentials approach: Using the client credentials grant
works only with development stores. When you try the same flow on a paid store, Shopify responds with:

Oauth error shop_not_permitted: Client credentials cannot be performed on this shop.

There’s also a good discussion about this limitation in the community thread here: https://community.shopify.dev/t/custom-app-credentials/27460/9