How Do I Create A Private API Key in Shopify?

How do I create a private API key in Shopify?

Every Shopify store can access the Shopify Application Programming Interface (API) via private credentials generated by the shop. There may be times when you need to provide these Private Shopify API credentials to a developer or third-party. They can be very useful for business activities like syncing important data with your CRM and ERP systems and sending orders to your shipping warehouse. A Private API Key differs from using a Shopify app so make sure this is the type of access that you require. Let’s review how to create a Shopify Private API Key and why you need it. 

 

Creating the Private API Key in Shopify

It only takes a few steps to generate the Private API Key. First, access the Apps section in your Shopify Admin page. From there you will scroll all the way down to the bottom of the page. You will see the “Manage private apps” link under the Recommended Apps section.

Clicking this link will open the “Private Apps” page in Shopify. If this is the first time you’ve visited this section, then Shopify will prompt you to enable and accept the terms before you can create a new API Key. Once you’ve enabled the access, you can click on the “Create new private app” button. This will then bring-up the “Private App” details form where you must configure the basic settings of the app. It’s best to only configure the minimum required access scopes as required for the integration. Granting too much permission opens the door to potential data theft if the API Keys ever fall into the wrong hands.

 

 

Clicking this link will open the “Private Apps” page in Shopify. If this is the first time you’ve visited this section, then Shopify will prompt you to enable and accept the terms before you can create a new API Key. Once you’ve enabled the access, you can click on the “Create new private app” button. This will then bring-up the “Private App” details form where you must configure the basic settings of the app. It’s best to only configure the minimum required access scopes as required for the integration. Granting too much permission opens the door to potential data theft if the API Keys ever fall into the wrong hands.

 


Is it Safe to Give an API Key to a third party? 

Security is important when you generate an API Key and API Secret. Treat the API key and password like any other piece of secure information because these credentials grant full API access to your store’s private data. If these keys fall into the wrong hands, then a hacker could potentially steal your store information and customer’s personal data. Any calls made using the API keys should utilize SSL security to ensure the data is encrypted.

 

 

Back to blog