Shopify

E-commerce Dev Dashboard app with client credentials (Windmill refreshes the token), or a legacy custom-app access token

Search and update orders, products, customers, inventory, fulfillments, discounts and store content on a Shopify store from any Windmill script, flow or app, through the GraphQL Admin API.

Set up in 4 steps

Create an app in the Dev Dashboard

Shopify no longer lets you create custom apps in the store admin (since January 1, 2026). In the Dev Dashboard (dev.shopify.com), create an app in the same organization as your store, enter the Admin API scopes your scripts need (for example read_products, write_products, read_orders, write_orders, read_customers), release a version and install it on the store. If you read customers or customer fields on orders, also select a protected customer data use under API access requests in the Partner dashboard.

Connect it in Windmill

Add a resource of type shopify and pick Shopify under the OAuth section. Enter the store subdomain (yourshop for yourshop.myshopify.com) and the app's client ID and secret from its settings page. Windmill exchanges them for an Admin API token and gets a new one before each 24-hour token expires; store_name is filled in for you.

Or paste an existing token

A custom app created in the store admin before 2026 still works: fill store_name with the subdomain and token with its shpat_ Admin API access token, which does not expire.

Run your first script

Run Get Shop or Search Orders to check the connection before writing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Trigger flows from Shopify

Shopify is not only a destination. These inbound paths are supported today.

Shopify webhooks on an HTTP route

Create a Windmill HTTP route, then subscribe it to the topics you need (orders/create, orders/paid, products/update, customers/create, inventory_levels/update…). From the admin: Settings, Notifications, Webhooks, Create webhook, JSON format. From your app: run the GraphQL Query script with a webhookSubscriptionCreate mutation. Set the route to Signature authentication, Custom scheme: header X-Shopify-Hmac-Sha256, sha256, base64, no prefix. The secret is the signing key shown under the admin's webhook list for admin-created webhooks, or the app's client secret for app-created ones. Order and customer topics need protected customer data access on the app. X-Shopify-Topic says which event arrived and X-Shopify-Webhook-Id lets you drop retried deliveries.

Resource type

The shape of the credential every script on this page expects.

shopify

View raw schema →

Field	Type	Required	What it is
store_name	string	Yes	The store's subdomain only: yourshop for yourshop.myshopify.com.
token	string	Yes	Admin API access token. Connect with OAuth (client credentials of a Dev Dashboard app installed on the store) to have Windmill refresh it, or paste a non-expiring shpat_ token from a custom app created in the Shopify admin.

Questions

What goes in store_name?

The subdomain alone. For yourshop.myshopify.com, enter yourshop. Your custom storefront domain will not work here.

Why do my scripts fail after a day with a pasted token?

Tokens from the client credentials grant expire after 24 hours. Connect through OAuth in the resource dialog so Windmill renews them, or use a non-expiring token from a custom app created in the admin before 2026.

A call fails with ACCESS_DENIED or a missing scope

Scopes come from the installed app version, not from the token request. Add the scope to the app in the Dev Dashboard, release a new version and approve the update on the store. "This app is not approved to access the Customer object" means the app still needs a protected customer data use selected in the Partner dashboard.

Why can't I see orders older than 60 days?

Shopify returns only the last 60 days of orders unless the app also has the read_all_orders scope.

Do the scripts use REST or GraphQL?

GraphQL Admin API, version 2026-10. Shopify has frozen the REST Admin API. IDs can be passed as numbers (as in webhook payloads and admin URLs) or as gid://shopify/... global IDs. The GraphQL Query script covers anything the other scripts don't.

Is my token stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

Set up in 4 steps

Create an app in the Dev Dashboard

Connect it in Windmill

Or paste an existing token

Run your first script

Scripts

Update Metaobject

Send Order Invoice

Run Bulk Query

Remove Tags

Release Fulfillment Order Hold

Process Return

List Metaobjects

Hold Fulfillment Order

GraphQL Query

Get Bulk Operation

Create Return

Create Metaobject

Add Tags

Delete Page

Update Product Variant

Create Customer

Get Discount Code

Complete Draft Order

Search Draft Orders

Create Custom Collection

Create Fulfillment

Get Fulfillment Order

List Fulfillment Orders

Update Page

Set Metafield

Create Product Variant

Cancel Order

Create Draft Order

Cancel Fulfillment Order

Refund Order

Trigger flows from Shopify

Shopify webhooks on an HTTP route

Resource type

shopify

Questions