We Spent Hours Fighting Shopify’s New Token Flow. Here’s What Actually Worked in 2026

by David Dorfmueller

We recently had to set up a fresh Shopify Admin API integration for Hermes. What should have been a quick task turned into a multi-hour rabbit hole.

The new Shopify Dev Dashboard and CLI frequently fails to expose the offline Admin API access token (shpat_...). Going through the official “Partners + shopify app” flow repeatedly gave us the same result: no visible token, confusing organization linking, and commands that returned nothing useful.

After enough wasted time, we went back to the basics and did it the old-fashioned way — directly inside the store admin.

The Working Process

  1. Go to Settings → Apps → Develop apps (at the bottom of the page).
  2. Create the app there (not via Partners):
    1. Give it a descriptive name.
    2. Go to the Versions sub-tab.
    3. In the URL section, set it to https://localhost/new-install.
    4. Turn Embed app in Shopify Admin off (unchecked).
    5. Leave API version on the most recent.
    6. Select all the scopes you will need now (take your time here).
    7. Ignore the optional scope.
    8. In the redirect box, set it to http://localhost (not https).
    9. At the bottom, click Release to release this version.
  3. Go to the Settings tab and copy both the Client ID and Secret ID into a scratch file. You’ll need them shortly.
  4. Go to the Home tab:
    1. Scroll down to Installs and click Install.
    2. Install it on your Shopify account.
    3. You may see a message that the app hasn’t been reviewed — ignore it.
    4. Click Install.
    5. You’ll be redirected to a non-existent page. This is normal.
  5. Now we need to obtain an access code/token.
  6. Construct this URL and paste it into your browser:
    https://<YOURSTORENAME>.myshopify.com/admin/oauth/authorize/?client_id=<YOURCLIENTID>&redirect_uri=http://localhost
  7. After redirecting to an error page, copy the full URL from the address bar. It will look something like:
    http://localhost/?code=<CODESTRING>&hmac=<HMACSTRING>&shop=<YOURSTORENAME>.myshopify.com&timestamp=...
  8. Extract the code= value from that URL.
  9. Go to Postman:
    1. Create an account and a new internal workspace.
    2. Create a New Request.
    3. Set the method to POST.
    4. Use the following fields (see image below).
      Here is the URL to POST: https://<YOURSTORENAME>.myshopify.com/admin/oauth/access_token
      also note that it says From_Step_9 it should say FROM_Step_8.
    Postman request setup
     
    1. Once you have done this, click Send.
    2. This step is time-sensitive. If you get a timeout, go back to step 6 and generate a new code, then quickly paste it into Postman and send again.
    3. You should receive a response containing your Shopify access token. Immediately copy the shpat_* token.
    Postman token response
    1. Add the token (and client ID) to Hermes in ~/.hermes/.env.
    2. Ask Hermes to validate access to Shopify. It should now work.

The Lesson

Shopify’s current recommended CLI/Partners flow is still unreliable for generating usable Admin API tokens in 2026. Creating the app directly inside the store admin and validating the token with Postman is the only method that has consistently worked for us.

We’ve now documented this as the standard process for anyone setting up new Shopify integrations with Hermes (or any other app).

If you’re fighting the same issue, follow these steps. Your future self will thank you.

Back to News