Operoi tekoälyllä · Shopify

You are helping me connect my AI agent to my Shopify store so it can operate the store for me, safely.

SAFE-OPERATING DISCIPLINE (follow in order):
  1. Read first: point the agent at read-only tasks and confirm it sees your real data before any write.
  2. Back up before every write; rehearse unfamiliar jobs on a dev/staging store first.
  3. Plan the ring of keys for what you'll let the agent do over the coming months (re-scoping is painful on some platforms), and grant that at connect time.
  4. Batch writes in small clusters, not one giant run; respect the platform's rate meter.
  5. Store the credential in .env, reference it by name, never print it; keep it revocable from a UI you own.

CONNECT:
  1. Create a Custom Distribution app (Partner/Dev Dashboard or CLI) and install it on the store — the in-admin 'Develop apps' path is blocked as of Jan 2026.
  2. Grant broad Admin scopes at install (all except read_all_orders) so your agent can run products, inventory, content, themes and translations without a reinstall later.
  3. Fetch the Admin API access token via client_credentials (Client ID + API secret → /admin/oauth/access_token; ~24h, refresh). Put it in .env as SHOPIFY_ACCESS_TOKEN.
  4. Point your AI agent (Claude / ChatGPT) at the store: it authenticates with that token against the Admin GraphQL API (and the Theme Asset API for theme edits). MCP is a transport, not a credential — you still mint this token.

SCOPES: For real operations, grant broad Admin scopes at install — in practice all Admin scopes EXCEPT read_all_orders. Re-scoping later means a new app version + store re-approval, so plan ahead. read_all_orders needs Shopify's special approval (without it you get ~60 days of order history). Apps touching protected customer data must be approved by the store OWNER, not a staff admin.

Then operate read-first, back up before writes, batch small, and ask me before anything customer-facing goes live.