Shopify Headless App Help: Storefront Tokens, Permissions and Setup

The channel holds the keys. Most of the skill is in where those keys end up and what they are allowed to do.

Storefronts and their tokens. Creating a storefront generates its public and private tokens. More storefronts are added under Sales channels > Headless > Add storefront, and each one counts as its own channel for order attribution.

Putting each token in the right place. Public tokens are built for browser or mobile code, where buyers can see them. Private tokens belong on the server, sent in their own header, and never in client code.

Forwarding the shopper's IP. Server-side requests made for buyers should send the Shopify-Storefront-Buyer-IP header. Without it, Shopify can't tell buyers apart, which can mean throttling, weaker bot protection and unauthenticated checkout flows.

Scoping permissions. Installing the channel creates a default permission set you can edit. Shopify's advice is to request only the scopes the app needs.

Rotating a private key. Generate the new token, move every app and script onto it, then delete the old one. Deletion can't be undone.

Deciding what each storefront sells. The channel supports product publishing, scheduled publishing, analytics and sales reporting by channel.

The site on top. The front end calling the API is its own build. Headless development specialists handle that part.

Any developer can install the channel. These questions show who has run a Storefront API integration under real traffic.

Which token goes where? Public token in the browser or app, private token only on the server. Anyone planning to put the private token in front-end code should not get the job.

How will you pass the buyer's IP? They should name the Shopify-Storefront-Buyer-IP header and know it is case-sensitive.

What happens when checkout creation is throttled? Shopify throttles it per minute and returns a 200 Throttled error. The answer you want is a request queue with exponential backoff, which is what Shopify suggests.

How do you treat bots? Bot and crawler traffic is rate limited, most strictly when unsigned, and Web Bot Auth signing raises the limits. Requests that look malicious get a 430 Shopify Security Rejection.

How do you rotate keys without downtime? New token first, every consumer updated, old token deleted last.

A first task worth paying for. One storefront with trimmed permissions, server requests carrying the buyer IP, and a one-page token map showing which key lives where. API integration specialists do this kind of work routinely.

100 per shop. A shop can have up to 100 active storefronts and access tokens.

Permissions are shared. Storefront and Admin API permissions apply across all storefronts, so one storefront can't be scoped more narrowly than another.

Deletes are final. Deleting a storefront invalidates its Storefront API tokens and can't be undone. A rotated private token stays valid until you delete it.

Some data needs no token. Tokenless access covers products, collections, selling plans, search, pages, blogs and articles, and cart, with a query complexity limit of 1,000. Product tags, metaobjects, metafields, menus and customers need a token.

Who can set it up. Setup needs a staff account with Apps and channels permissions.

Rate limits target bots. Buyer traffic has no fixed requests-per-minute limit; bots and crawlers are limited.

Plus bot protection is narrow. On Shopify Plus it applies to the Cart object only, not Checkout.

Orders name the storefront. The Channel column on the Orders page shows which storefront made each sale.

Each of these is a contained job, separate from building the front end.