Shopify AI Agents: APIs, Scopes, and the Write Boundary (2026)
Quick summary: There is no native Shopify AgentCore connector. Pin Admin GraphQL, start with read scopes, and keep write_orders off. Browser-on support turns have run about 3× the platform spend.
Key Takeaways
- Browser-on support turns have run about 3× the platform spend
- On 25 September 2026 there is still no native Shopify connector for Amazon Bedrock AgentCore
- An agent that "runs on Shopify" is an app you own, calling the Admin API, with tools in front of it
- Operators who want the support job, not the API, should start at the customer support agent
- What you call Shopify's GraphQL Admin API is the surface to pin
Table of Contents
On 25 September 2026 there is still no native Shopify connector for Amazon Bedrock AgentCore. An agent that “runs on Shopify” is an app you own, calling the Admin API, with tools in front of it. The cross-system pattern is how agents talk to Shopify, ERP, CRM, and WMS. This page is Shopify only.
Who this is for. A CTO or commerce engineer. Operators who want the support job, not the API, should start at the customer support agent.
Our take: read scopes, fixed queries, webhooks as signals. write_orders is a separate project with a person in the loop. We would rather ship lookups than a refund bot.
What you call
Shopify’s GraphQL Admin API is the surface to pin. REST Admin still exists for older apps; new work should not add a second client “just in case.” Every request carries X-Shopify-Access-Token. The token comes from an app install, not from a staff password pasted into a secret.
Scopes are declared on the app and granted by the merchant. Shopify’s scope guide is the list that matters; each field in the GraphQL reference names the scope it needs. Start from the reads the workflow uses:
- Orders and fulfillment status for where-is-my-order
- Products and variants for a catalog answer
- Inventory levels when the question is availability
Do not add write_orders, refund, or price-list writes because a later phase might want them. A custom app created in the Shopify admin with every scope selected is unrestricted access with a friendlier name.
Protected customer fields (email, address, phone) are a product decision. If the lookup can key off an order id the shopper already has, do not return the full address to the model.
Webhooks
Webhook subscriptions need the scope that matches the topic. App-specific subscriptions in shopify.app.toml apply to every install. Shop-specific ones use webhookSubscriptionCreate. Destinations include HTTPS, Google Pub/Sub, and AWS EventBridge. The API version follows the app’s webhook version; you do not pick it per subscription.
Use a webhook to invalidate a cached order. Do not let the model “handle” the JSON. Verify the webhook HMAC Shopify documents before you trust the body. Replay the same event twice in a test. Your consumer must not create a second side effect.
audit_events/admin_api_activity is a Plus-oriented topic with its own scope and a destination limit (Pub/Sub or EventBridge). It is useful for “what did the app call.” It is not a substitute for your own trace of what the model asked.
Tools, approval, failure
| Tool | Week one | Not a tool |
|---|---|---|
getOrder | Yes, fixed query | Raw GraphQL from the model |
getFulfillment | Yes | Guessing a carrier URL |
getVariantAvailability | Yes, with asOf | Averaging two locations |
refundCreate | No | A prompt that says be helpful |
orderCancel | No | Retrying a timeout as a different mutation |
When Admin returns 429, honor Retry-After inside the adapter and tell the model the shop is busy. Do not loop. When the order and the fulfillment disagree, say so and hand off. The human queue is the design in the support post.
AgentCore hosting, if you use it, is store agents on AgentCore. Harness has been GA since 17 June 2026. Put the OpenAPI spec on Gateway. Do not put the Admin token in the prompt.
What broke — A pilot left a Storefront token and an Admin token in the same secret. A shopper-scoped session called the Admin client because the tool did not check the audience. Detection: a trace showed
read_orderson a session that had only a storefront customer id. Fix: two credentials, two tool sets, and a deny when the caller is the shopper. Lesson: Shopify will not infer your role split.
Browser tools that scrape the admin have run about 3× the platform spend on support-shaped pilots. The admin API exists. Use it.
If you only do one thing
Open the app’s granted scopes. If write is present, remove it before any model can call the client.
What to do this week
- Pin an Admin API version and one read query for orders.
- Create the app with those scopes only. Install on a development store.
- Subscribe to one order topic via EventBridge or HTTPS, with HMAC checks.
- Reject arbitrary GraphQL in code review.
- Read Magento or BigCommerce only if you also run those. Do not copy Shopify scopes across.
- Discuss the architecture against eCommerce AI agents. The library is /resources/ecommerce-ai-agents/.
What this post doesn’t cover
- Theme app extensions and checkout UI extensions. Those are storefront UX, not an agent tool.
- Shopify Catalog’s ChatGPT path beyond what OpenAI has published. We do not have a private partner addendum.
- A measured ticket-deflection rate. We are not publishing one.
- Plus-only features as if every store has them.
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
