BusyBot

Reference · Credentials

Shopify API credentials

Used by 2 BusyBot nodes.

Type shopifyApi 3 fields

The Shopify credential holds your store subdomain and an Admin API access token from a custom app you install on the store. The trigger additionally needs the app's secret key, which is what verifies that incoming webhooks really came from Shopify.

Fields

FieldTypeRequiredNotes
Shop Subdomain
shopSubdomain		 string Yes Your Shopify store subdomain (e.g. mystore, without .myshopify.com)
Access Token
accessToken		 password Yes Shopify Admin API access token (X-Shopify-Access-Token header)
App Secret Key
appSecretKey		 password No Shopify app secret key for webhook HMAC-SHA256 signature verification

Getting your credentials

  1. In your Shopify admin, open the apps area and create a custom app for this integration.
  2. Configure its Admin API scopes, granting only what the workflow needs — for example read and write on products or orders.
  3. Install the app on the store and reveal the Admin API access token. It is shown once.
  4. Set Shop Subdomain to just the store name — mystore, not mystore.myshopify.com and not the full URL.
  5. Paste the token into Access Token.
  6. If you use the Shopify trigger, copy the app’s secret key into App Secret Key so webhook HMAC-SHA256 signatures can be verified.

Permissions and scopes

Admin API scopes are granular and are set when the custom app is configured. Adding a scope later requires updating the app; the existing token then covers it. Grant the minimum the workflow uses — an over-scoped store token is a serious liability.

Protected customer data may require additional approval in Shopify before those fields are returned.

Troubleshooting

  • 401 or 404 on every call — the shop subdomain includes .myshopify.com or a protocol. It should be the bare store name.
  • 403 on a resource — the custom app was not granted that Admin API scope.
  • Webhook signature verification fails — the App Secret Key is missing or belongs to a different app than the one that created the webhook.
  • Customer fields empty — protected customer data access has not been approved for the app.

Frequently asked questions

What exactly goes in Shop Subdomain?

Just the store name, such as `mystore`. Including `.myshopify.com` or `https://` breaks every request, and is the most common setup error here.

When do I need the App Secret Key?

For the Shopify trigger, which uses it to verify the HMAC-SHA256 signature on incoming webhooks. Action-only workflows do not need it.

Custom app or public app?

A custom app installed on your own store is right for automation. Public apps are for distributing to other merchants through the app store.

Why are customer fields blank?

Shopify gates protected customer data behind an approval step for the app. Authentication succeeding does not imply those fields are returned.

Nodes that use Shopify API

One credential works across every node below — create it once and reuse it.

Last updated . Spotted something wrong? Tell us.