Shopify

Shopify

This connector reads and updates a Shopify store through the GraphQL Admin API (https://<store>.myshopify.com/admin/api/2026-10/graphql.json, API version 2026-10): shop settings, products and variants, stock per location, orders with their fulfillment orders, and customers. It can change a variant's price, adjust stock and mark items as shipped with tracking.

Setup (store owner, about 10 minutes)

Since 1 January 2026 new custom apps can no longer be created inside the store admin; they are made in the Dev Dashboard. A custom app installed on a store of your own organization gets its access token through the client credentials grant, which is what this connector uses. Nothing is published to the Shopify App Store and no review is needed.

1. Open the Dev Dashboard at https://dev.shopify.com/dashboard/ with the account that owns the store (or a staff account with the App development → Develop permission). The store must belong to the same Shopify organization as the app.
2. Apps → Create app → Start from Dev Dashboard, give it a name (for example "AnythingMCP") and click Create.
3. Open Versions, fill in the App URL (any https URL, for example your shop's address; this connector does not use it), pick the newest webhooks API version, add the Admin API scopes from the table below, then click Release.
4. On the app's overview, click Install app in the Installs card, pick your store and confirm Install. Until the app is installed the token request fails.
5. Open App settings and copy the Client ID and Client secret into SHOPIFY_CLIENT_ID and SHOPIFY_CLIENT_SECRET.
6. Set SHOPIFY_STORE to the store's myshopify handle: for acme-shop.myshopify.com enter acme-shop. It is in the admin URL (admin.shopify.com/store/<handle>) and under Settings → Domains. A custom domain such as acme.com does not work here.

The connector exchanges the client ID and secret at https://<store>.myshopify.com/admin/oauth/access_token for an access token, which Shopify issues for 24 hours, and fetches a new one before it expires. The token is sent in the X-Shopify-Access-Token header. Changing scopes means releasing a new app version; the next token carries the new scopes.

Apps created in the store admin before 2026 (with a shpat_… token) keep working in Shopify, but this connector uses the Dev Dashboard flow above.

Scopes

For a read-only setup leave out the write_* scopes and switch the three write tools off on the connector page. read_orders only reaches orders from the last 60 days; older orders also need read_all_orders, which Shopify grants on request. Fulfillment orders assigned to a fulfilment app or third-party warehouse need the *_assigned_fulfillment_orders or *_third_party_fulfillment_orders scopes instead of the merchant-managed ones.

Customer data: names, emails, phone numbers and addresses are protected customer data. If customer or order tools fail with "This app is not approved to access the Customer object" (or a similar message for name, email, phone or address fields), request access once: Partner Dashboard (partners.shopify.com) → Apps → the app → API access requests → Protected customer data access → Request access, tick the fields the AI should read (name, email, phone, address) with a short reason each, and Save. For an app used only on your own or a development store that is enough: no review is needed and the calls work right away.

Ids

Every id is a global id (GID) such as gid://shopify/Product/1234567890, gid://shopify/ProductVariant/…, gid://shopify/Order/… or gid://shopify/Location/…. Pass them whole. The order number customers see (#1001) is the order's name: find the order with shopify_search_orders and query: "name:#1001".

A variant's stock lives on its inventory item (inventoryItem.id in shopify_get_product), with one level per location. To change stock: shopify_get_product → shopify_list_inventory_levels (current quantities and location ids) → shopify_adjust_inventory.

To ship an order: shopify_get_order → take the id of an open fulfillment order (and, for a partial shipment, the ids of its line items) → shopify_create_fulfillment with carrier and tracking number.

Searching and paging

The search tools take Shopify's search syntax in query: field:value terms joined by spaces (AND) or OR, comparisons such as created_at:>=2026-10-01 or inventory_total:<5, - to negate a term, and * as a wildcard (title:*hoodie*). Dates are ISO 8601, read in the store's time zone.

Lists are cursor-paged: first sets the page size (at most 250) and the answer carries pageInfo { hasNextPage endCursor }. Pass endCursor as after for the next page while hasNextPage is true.

Money

Prices are decimal strings in the store currency ("29.90"). Order amounts are money bags; shopMoney is in the store currency.

Errors

• The GraphQL API answers HTTP 200 for most problems. Errors in the query itself, missing scopes ("Access denied for … field") and throttling come back in errors: the tool call then fails with GraphQL errors: [...] and Shopify's message.
• A mutation Shopify refuses (unknown variant, invalid price, stale quantity, fulfillment order already closed) does not fail the call: the result has a non-empty userErrors list with field and message. Check it after every write.
• 401: the token request was refused (wrong client ID or secret, or the app is not installed on this store). 402: the store is frozen for unpaid bills. 423: the store is locked. 404: wrong store handle.

Rate limits

The Admin GraphQL API is limited by query cost, not by the number of requests: each app and store pair refills 100 points per second on the Standard plans (200 on Advanced, 1,000 on Plus, 2,000 on Enterprise), and no single query may cost more than 1,000 points. A list costs roughly its first value, so large pages and nested lists cost more. When the budget runs out Shopify answers with a THROTTLED error: wait a few seconds and retry, or ask for smaller pages. This connector returns only the data part of each answer, so the cost figures Shopify reports in extensions.cost are not shown.

Other operations

The generated shopify_graphql_query and shopify_graphql_mutation tools run any other Admin API operation (draft orders, discounts, collections, metafields…) within the scopes the app was given; shopify_graphql_schema looks up types and fields first.