How to create a Shopify custom app and get its Client ID and Secret (2026 guide)

Almost every tool that places orders on your behalf, including a bulk-order tool for barter and seeding, asks for two values from Shopify: a Client ID and a Client secret. You get them by creating a custom app. It takes about five minutes if you know where to click, and this guide walks through the current Shopify admin exactly as it looks in 2026.

What a custom app actually is

A custom app is a set of permissions that belongs to one store. It is not code you write and it is not listed anywhere public. You create it, choose what it is allowed to do (read products, create orders, and so on), install it on your store, and Shopify gives you credentials. Any tool holding those credentials can act on your store within exactly those permissions, nothing more.

Shopify moved custom app creation into the Dev Dashboardin 2025. The old “Develop apps” page inside the admin still exists as the entry point, but it now hands you over to the Dev Dashboard. If you have followed an older guide and could not find the buttons it described, that is why.

Before you start

• You need to be the store owner or a staff member whose permissions include developing apps. If the Develop apps button is greyed out or missing, ask the owner to grant that permission or do this step themselves.
• Have your bulk-order tool's connection form open in another tab, ready to paste into.
• Know your store domain in the form your-store.myshopify.com, not the custom domain.

The exact clicks

1. Settings, then Apps and sales channels, then Develop apps

From your Shopify admin, open Settings (bottom left), click Apps and sales channels, then Develop apps. Shopify opens the Dev Dashboard. If it asks you to agree to developer terms or create a developer account with your existing login, accept and continue. That is a one-time step.

2. Create the app

Click Create app. Give it a name that tells you what it is for, such as “Bulk orders for creators”. Names are internal. You can change them later, and nothing customer-facing ever shows them.

3. Create a version and set the Admin API access scopes

Inside the app, open Versions and create a new version. Under Access, choose Admin API access scopes. This is the part people rush, so here is what each scope a bulk-order tool typically asks for actually allows and why it needs it.

Notice what is not on that list. A bulk-order tool does not need write access to products, inventory adjustments, payouts, or your theme. If a tool asks for far more than it needs, that is a reason to ask why. Tick only what the tool documents, then save the version.

4. Release the version

This step is the most common miss. Scopes live in versions, and only a released version counts. Click Release on the version you just saved. If you edit scopes later, you release again, and you will usually need to reinstall so the store accepts the new permissions.

5. Install the app on your store

Click Install and choose the store. Shopify shows a permissions screen listing the scopes in plain language. Approve it. From this moment the app exists on that store only; it cannot touch any other store you own.

6. Open App settings and copy the Client ID

Back in the app, open Settings. You will see the Client ID as a long string of letters and numbers. Copy it into your tool. The Client ID is effectively a username: it identifies the app but does nothing on its own.

7. Reveal and copy the Client secret (shown once)

Below the Client ID is the Client secret. Click to reveal it and copy it straight into your tool's connection form. Shopify shows it once. If the tab closes before you paste, you will not be able to read it again; you will have to regenerate it, which invalidates the old one.

8. Paste into the tool and verify

Enter your myshopify.com domain, the Client ID and the Client secret. A well-built tool will immediately test the connection and show you a scope-by-scope checklist. If everything is ticked, you are done and can move on to placing your first batch of orders.

What happens with these credentials (no OAuth screen)

You never see a Shopify login or consent popup after this, and people sometimes worry that means something is wrong. It is not. Custom apps use what Shopify calls the client credentials grant:

1. The tool sends your Client ID and Client secret to Shopify's token endpoint for your store.
2. Shopify replies with an access token that is valid for about 24 hours.
3. The tool uses that token on every API call: reading products, creating customers, placing orders.
4. When the token is about to expire, the tool quietly requests a fresh one using the same credentials.

The practical result: you connect once, and it keeps working for months without anyone logging in again. This is also why the secret must be stored encrypted; whoever has it can mint tokens.

Common errors and what they mean

• 403 Forbidden on placing an order. A scope is missing, or you ticked it but did not release or reinstall. Open the version, confirm write_orders is ticked, release, reinstall, then re-check in the tool.
• Products list is empty or 403. Same cause with read_products. Also check that your products are Active, not Draft; draft products are not sellable on an order.
• 401 Unauthorized / “invalid client” after it used to work. Someone regenerated the Client secret, or the app was uninstalled. Copy the new secret into the tool (a reconnect), or reinstall the app.
• Cannot find Develop apps at all. Your staff account lacks the app development permission. The store owner can grant it under Settings, Users and permissions, or create the app themselves.
• “Change your plan to allow customers to checkout”. This is not a credentials problem. It appears when a tool completes draft orders on a trial or development store. Tools that create orders directly with write_orders avoid it; see draft orders at scale for the details.

Security hygiene that takes two minutes

• Least scope. Grant what the tool documents, nothing extra. Fewer scopes means less damage if something leaks.
• One app per tool. If you use two tools, make two custom apps. Then you can revoke one without breaking the other.
• Name it clearly.Six months from now someone will ask what “test app 2” does. Save them the audit.
• Rotate if leaked. Pasted into the wrong chat? Regenerate the secret in the Dev Dashboard immediately, then reconnect the tool. Old tokens die within a day; new ones cannot be issued with the old secret.
• Uninstall when done. Stopped using a tool? Uninstall its app. Credentials for an uninstalled app stop working.

If you are an agency connecting several brands

Every brand's store needs its own custom app, created from that brand's admin by someone with the right permission. The cleanest process is to send the brand this guide, have them create the app and paste the credentials directly into a workspace you have set up for them, so the secret never passes through your inbox. The agency playbook covers how to structure that per-brand setup, and the agencies page shows what a multi-brand workspace looks like.

What to do once you are connected

With the app installed and scopes verified, the boring part is over. Next comes the data: a clean sheet of creators, SKUs, phones and addresses. The seeding operations checklist and address clean-up guide will save you from the two mistakes that cause most RTOs. After that, tag conventions matter; see order tags for barter and seeding.

If placing creator orders by hand is eating your week, you can try it free and see your own list placed in minutes.