Shopify
Connect Shopify to manage orders, products, customers, inventory, and fulfillment across your store.
You end up with three things to paste into PopMCP: your *.myshopify.com store domain, plus the Client ID and Client secret of an app you create in the Shopify Dev Dashboard. You then tick the permissions and let PopMCP run the OAuth install.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://{shop}.myshopify.com/admin/api
- Rate limits
- The GraphQL Admin API uses a leaky-bucket cost model, roughly a 1,000-point bucket refilling at 100 points per second on standard plans and ten times that on Shopify Plus. The REST Admin API allows about 2 requests per second per store.
Before you begin
- A Shopify store you can install apps on, plus the store's *.myshopify.com domain
- A Shopify account with access to a Dev Dashboard organization at dev.shopify.com
- Store owner, or a staff account with the 'Manage and install apps' permission, to approve the install
- PopMCP's callback URL, copied from the Shopify connect form. It has to be pasted into the app before you connect
Get your credentials
Create an app in the Dev Dashboard
Open Apps in the left navigation and click Create app in the top right. Choose Start from Dev Dashboard, name the app PopMCP, and click Create.
Apps
Build and manage the apps in this organization.
| App | Distribution | Status | Created |
|---|---|---|---|
| Warehouse syncCustom distribution | 1 store | Installed | Mar 4, 2026 |
| Returns portalCustom distribution | Not distributed | Draft | Feb 2, 2026 |
Legacy custom apps made in the Shopify admin keep working.
Add PopMCP's redirect URL and the access scopes, then release
Open the app's Versions tab. Paste PopMCP's callback URL into Redirect URLs, set the App URL to the same host, tick the scopes the tools need, and click Release.
Versions
Configuration takes effect only once a version is released.
Redirect URLs must match byte for byte, trailing slash included.
Copy the Client ID and Client secret
Open the app's Settings tab and find the Credentials section. Copy the Client ID and the Client secret.
Settings
- Client ID
- 7f3c****************b91a
- Client secret
- ••••••••••••••••••••c40e
- App handle
- popmcp
Access tokens do not appear anywhere in this UI. The client credentials are what you hand to PopMCP.
Find your store domain
In the Shopify admin, open Settings, then Domains, and copy the *.myshopify.com row. The same handle appears in the admin URL as admin.shopify.com/store/\<handle>.
Connect from PopMCP and approve the install
Paste the store domain, Client ID and Client secret into PopMCP, leave the default permissions ticked, and click connect. On Shopify's install screen, review the scopes and click Install.
Connect in PopMCP
Open your workspace, choose Shopify in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Store domaintext | Your *.myshopify.com domain (or just the store handle). |
| Client IDtext | From your app's Client credentials in the Shopify Dev Dashboard. |
| Client secretsecret | Stored encrypted and used only server-side — it never reaches the browser.Encrypted with AES-256-GCM on save and never shown again. |
| Permissions to requestchecklist | Shopify grants exactly what you tick here. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them. |
https://app.popmcp.com/api/providers/shopify/callbackAdd this exact URL to your Shopify app's allowed redirection URLs (Dev Dashboard → your app → Configuration) before authorizing. It must match character for character or Shopify rejects the authorization.
PopMCP verifies the credential against Shopify immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions to request
PopMCP asks Shopify for exactly the permissions you tick in the connect form. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.
Shopify grants exactly what you tick. 22 of 50 are on by default.
Products & inventory
read_productsRead products, variants and collectionswrite_productsCreate and update products, variants and collectionsread_inventoryRead inventory levels and itemswrite_inventoryAdjust inventory levelsread_locationsRead locationsNeeded to read or set stock at a specific location.read_filesRead fileswrite_filesUpload and delete files
Orders & fulfillment
read_ordersRead orders, transactions and refundswrite_ordersCreate, update, cancel and refund ordersread_all_ordersRead orders older than 60 daysRequires Shopify's approval first: Partner Dashboard → your app → API access → "Read all orders" → Request access. Ticking this before you are approved makes Shopify reject the whole authorization. Without it, every order query is capped at the last 60 days.read_draft_ordersRead draft orderswrite_draft_ordersCreate and complete draft ordersread_fulfillmentsRead fulfillments and fulfillment serviceswrite_fulfillmentsCreate and update fulfillmentsread_assigned_fulfillment_ordersRead fulfillment orders assigned to this appread_merchant_managed_fulfillment_ordersRead merchant-managed fulfillment ordersread_third_party_fulfillment_ordersRead third-party fulfillment ordersread_returnsRead returnswrite_returnsRequest and process returnsread_shippingRead shipping rates and zoneswrite_shippingManage shipping rates and zones
Customers
read_customersRead customers and addressesCustomer data is protected: Shopify may redact fields until your app is approved for protected customer data.write_customersCreate and update customers
Pricing & promotions
read_discountsRead discountswrite_discountsCreate and update discountsread_price_rulesRead price rules and discount codeswrite_price_rulesCreate and update price rules and discount codesread_gift_cardsRead gift cardsShopify Plus stores only.write_gift_cardsIssue and update gift cardsShopify Plus stores only.
Content & storefront
read_contentRead blogs, articles, pages and commentswrite_contentCreate and update blogs, articles and pagesread_themesRead themes and theme assetswrite_themesEdit themes and theme assetsread_online_store_navigationRead online-store menusread_script_tagsRead script tagswrite_script_tagsAdd and remove script tags
Metafields & metaobjects
read_metaobjectsRead metaobjectswrite_metaobjectsCreate and update metaobjectsread_metaobject_definitionsRead metaobject definitionswrite_metaobject_definitionsCreate and update metaobject definitions
Marketing & reporting
read_marketing_eventsRead marketing eventswrite_marketing_eventsCreate and update marketing eventsread_reportsRead reportsread_marketsRead marketsread_localesRead shop localesread_translationsRead translated content
Payments & finance
read_shopify_payments_payoutsRead Shopify Payments payouts and balanceread_shopify_payments_disputesRead Shopify Payments disputesread_payment_termsRead payment termsread_customer_payment_methodsRead stored customer payment methodsProtected customer data; needs Shopify approval.
Verify it worked
After the Shopify install screen, PopMCP shows the connector as Connected with your store handle. Asking for recent orders or a product count returns real data from that store.
Troubleshooting
"The redirect_uri is not whitelisted" during install
Why: PopMCP's callback URL is not in the app's Redirect URLs, or the released version does not include it.
Fix: Paste the callback URL exactly as PopMCP shows it into Versions, Redirect URLs, then click Release. Unreleased edits are not live.
"redirect_uri and application URL must have matching hosts"
Why: The App URL and the redirect URL point at different hosts.
Fix: Set the App URL to the same origin as PopMCP's callback URL, then release again.
401 or "Invalid API key or access token" on every call
Why: The client secret was rotated in the Dev Dashboard, or a legacy custom-app admin token was pasted into the Client secret box.
Fix: Copy the current Client ID and Client secret from the app's Settings, Credentials section and reconnect.
Some tools return 403 with an access-scope error
Why: That scope was not ticked when you authorised. Shopify grants only what was requested, so unticked permissions leave those tools listed but failing.
Fix: Tick the missing scope on the app version, click Release, then reconnect in PopMCP so the merchant re-approves the wider list.
Orders older than 60 days come back empty
Why: Standard read_orders only covers the last 60 days.
Fix: Request the read_all_orders scope from Shopify for the app, then reconnect.
Merchants lose access after you rotate the secret
Why: The old secret was revoked before stored tokens were updated.
Fix: Keep both secrets valid until PopMCP has reconnected, then revoke the old one.