--- title: Shopify AI Agents: APIs, Scopes, and the Write Boundary (2026) description: There is no native Shopify AgentCore connector. Pin Admin GraphQL, start with read scopes, and keep write_orders off. Browser-on support turns have run about 3× the platform spend. url: https://www.factualminds.com/blog/shopify-ai-agents-ecommerce-2026/ datePublished: 2026-09-25T00:00:00.000Z dateModified: 2026-09-25T00:00:00.000Z author: palaniappan-p category: AI Agents tags: ai-agents, ecommerce, shopify, bedrock-agentcore, security --- # Shopify AI Agents: APIs, Scopes, and the Write Boundary (2026) > There is no native Shopify AgentCore connector. Pin Admin GraphQL, start with read scopes, and keep write_orders off. Browser-on support turns have run about 3× the platform spend. On **25 September 2026** there is still **no native Shopify connector** for Amazon Bedrock AgentCore. An agent that "runs on Shopify" is an app you own, calling the Admin API, with tools in front of it. The cross-system pattern is [how agents talk to Shopify, ERP, CRM, and WMS](/blog/ai-agent-ecommerce-integration-2026/). This page is Shopify only. **Who this is for.** A CTO or commerce engineer. Operators who want the support job, not the API, should start at [the customer support agent](/blog/ai-customer-support-agent-ecommerce-2026/). **Our take:** read scopes, fixed queries, webhooks as signals. `write_orders` is a separate project with a person in the loop. We would rather ship lookups than a refund bot. ## What you call Shopify's [GraphQL Admin API](https://shopify.dev/docs/api/admin-graphql/latest) is the surface to pin. REST Admin still exists for older apps; new work should not add a second client "just in case." Every request carries `X-Shopify-Access-Token`. The token comes from an app install, not from a staff password pasted into a secret. Scopes are declared on the app and granted by the merchant. Shopify's scope guide is the list that matters; each field in the GraphQL reference names the scope it needs. Start from the reads the workflow uses: - Orders and fulfillment status for where-is-my-order - Products and variants for a catalog answer - Inventory levels when the question is availability Do not add `write_orders`, refund, or price-list writes because a later phase might want them. A custom app created in the Shopify admin with every scope selected is unrestricted access with a friendlier name. Protected customer fields (email, address, phone) are a product decision. If the lookup can key off an order id the shopper already has, do not return the full address to the model. ## Webhooks [Webhook subscriptions](https://shopify.dev/docs/apps/build/webhooks/subscribe) need the scope that matches the topic. App-specific subscriptions in `shopify.app.toml` apply to every install. Shop-specific ones use `webhookSubscriptionCreate`. Destinations include HTTPS, Google Pub/Sub, and **AWS EventBridge**. The API version follows the app's webhook version; you do not pick it per subscription. Use a webhook to invalidate a cached order. Do not let the model "handle" the JSON. Verify the webhook HMAC Shopify documents before you trust the body. Replay the same event twice in a test. Your consumer must not create a second side effect. `audit_events/admin_api_activity` is a Plus-oriented topic with its own scope and a destination limit (Pub/Sub or EventBridge). It is useful for "what did the app call." It is not a substitute for your own trace of what the model asked. ## Tools, approval, failure | Tool | Week one | Not a tool | | --- | --- | --- | | `getOrder` | Yes, fixed query | Raw GraphQL from the model | | `getFulfillment` | Yes | Guessing a carrier URL | | `getVariantAvailability` | Yes, with `asOf` | Averaging two locations | | `refundCreate` | No | A prompt that says be helpful | | `orderCancel` | No | Retrying a timeout as a different mutation | When Admin returns 429, honor `Retry-After` inside the adapter and tell the model the shop is busy. Do not loop. When the order and the fulfillment disagree, say so and hand off. The human queue is the design in the support post. AgentCore hosting, if you use it, is [store agents on AgentCore](/blog/ecommerce-ai-agents-amazon-bedrock-agentcore-2026/). Harness has been GA since **17 June 2026**. Put the OpenAPI spec on Gateway. Do not put the Admin token in the prompt. > **What broke** — A pilot left a Storefront token and an Admin token in the same secret. A shopper-scoped session called the Admin client because the tool did not check the audience. **Detection:** a trace showed `read_orders` on a session that had only a storefront customer id. **Fix:** two credentials, two tool sets, and a deny when the caller is the shopper. **Lesson:** Shopify will not infer your role split. Browser tools that scrape the admin have run about **3×** the platform spend on support-shaped pilots. The admin API exists. Use it. ## If you only do one thing Open the app's granted scopes. If write is present, remove it before any model can call the client. ## What to do this week 1. Pin an Admin API version and one read query for orders. 2. Create the app with those scopes only. Install on a development store. 3. Subscribe to one order topic via EventBridge or HTTPS, with HMAC checks. 4. Reject arbitrary GraphQL in code review. 5. Read [Magento](/blog/magento-ai-agents-ecommerce-2026/) or [BigCommerce](/blog/bigcommerce-ai-agents-ecommerce-2026/) only if you also run those. Do not copy Shopify scopes across. 6. [Discuss the architecture](/contact-us/?focus=ai-agents) against [eCommerce AI agents](/services/ecommerce-ai-agents/). The library is [/resources/ecommerce-ai-agents/](/resources/ecommerce-ai-agents/). ## What this post doesn't cover - Theme app extensions and checkout UI extensions. Those are storefront UX, not an agent tool. - Shopify Catalog's ChatGPT path beyond what OpenAI has published. We do not have a private partner addendum. - A measured ticket-deflection rate. We are not publishing one. - Plus-only features as if every store has them. ## FAQ ### When should you NOT connect an agent to the Shopify admin token? Always, if the token is a staff credential or a custom app with every scope. Use an app token, request only the reads the workflow needs, and put those reads behind named tools. A prompt that says read-only does not remove write_orders. ### What could go wrong if the agent sends arbitrary GraphQL? The model will eventually ask for a mutation that the token allows. Expose getOrder and getProduct as tools with fixed queries. Do not pass a GraphQL string through from the model. ### Do Shopify merchants need a custom feed for ChatGPT? OpenAI says Shopify Catalog already supplies product data to ChatGPT and that individual merchants do not build a second feed for that path. You still have to be accurate in Shopify. Checkout inside ChatGPT is a separate, approved-partner program. ### What could go wrong if webhooks are the agent's only memory? A missed webhook becomes a stale answer, and a replay becomes a duplicate side effect if you treat the webhook as a command. Use webhooks to refresh your read model. Writes still go through an idempotent tool with a person on money movement. ### Is the Storefront API enough for a support agent? No. Storefront API is the buyer-facing surface. Order lookup for a signed-in associate needs Admin API reads. Do not give the shopper-facing agent the associate token. --- *Source: https://www.factualminds.com/blog/shopify-ai-agents-ecommerce-2026/*