Shopify API authentication in n8n: custom app token vs OAuth2

Shopify API authentication in n8n is the step that stalls most store owners before a single workflow runs, usually with a blunt 401 Unauthorized and no clue why. This guide clears it up: the difference between a custom app access token and OAuth2, which one your store actually needs, how to attach the credential to both the Shopify node and a plain HTTP Request, the scopes that matter, and a repeatable way to catch a broken connection before your automations quietly fail.

New to connecting Shopify and n8n at all? Start with the 2026 Shopify to n8n connection walkthrough first, then come back here for the auth mechanics and error fixes.

What it does

This guide gives you two things. First, a clear model of how Shopify authenticates API calls and how n8n plugs into that model, so you stop guessing. Second, a small, importable workflow that puts the theory to work: it calls the Shopify shop.json endpoint on a schedule using your credential, checks the response, and pings Telegram the moment authentication breaks. That last part matters because a revoked token or an expired API version fails silently, and you often only notice when a day of orders never synced.

Shopify offers two authentication methods for the Admin API, and n8n supports both as native credential types:

• Custom app access token — a single permanent token you create inside your own store’s admin. This is the right choice for automating one store you control.
• OAuth2 — the standard install flow used when an app connects to stores owned by other people. n8n runs the OAuth handshake and stores the resulting token for you.

Why it beats the default

The instinct is to paste an API key straight into an HTTP Request node and move on. That works until it does not, and when it fails the error is always the same unhelpful 401. The approach here is better for three reasons.

You create the credential once and reuse it everywhere. Both the Shopify node and any HTTP Request node point at the same stored credential, so rotating a token is a one-place change instead of a hunt through every workflow. n8n injects the X-Shopify-Access-Token header for you, so the token never sits in plain text inside a node parameter or an exported JSON file. And because the same credential drives the raw HTTP calls, you can reach endpoints the Shopify node does not expose, like shop.json, without a second set of keys.

The health-check pattern on top of that turns authentication from a thing you hope still works into a thing you get told about. Six times a day it proves the token is valid, and if it is not, you hear about it in Telegram in seconds rather than in a customer complaint next week.

What you need

• An n8n instance, cloud or self-hosted, version 1.0 or newer.
• A Shopify store where you are staff with permission to create a custom app. Custom apps are created through the store admin at Settings → Apps and sales channels → Develop apps, which Shopify surfaces via the modern Dev Dashboard flow. See the connection walkthrough for the click-by-click on generating the token.
• A Telegram bot token and your chat ID, for the failure alert. Swap in Gmail if you prefer email.
• Roughly 20 minutes to build from scratch, or a couple of minutes with the template below.

Node-by-node list

The workflow is six nodes and one clean path with a single branch at the end.

[Every 6 Hours]      Schedule trigger
      |
[Store Config]       your myshopify domain + API version
      |
[Call Shop Endpoint] HTTP Request -> GET /admin/api/2026-04/shop.json
      |               (Shopify Access Token credential, neverError on)
[Auth OK?]           IF statusCode == 200
      |------ true  --> [Healthy Summary]   Set node, records the shop name
      |------ false --> [Send Auth Alert]   Telegram warning with the status code
  

Step-by-step build

1. Create the Shopify credential. In n8n go to Credentials, click New, and search for Shopify Access Token API. Enter your store’s subdomain (the part before .myshopify.com), the API key and secret from your custom app, and the access token. Save it. This is the custom app token method. For OAuth2, pick Shopify OAuth2 API instead and complete the Connect flow in the browser.
2. Add the Schedule Trigger. Drop a Schedule Trigger node and set the interval to every 6 hours. This is your entry point.
3. Add a Set node named Store Config. Create two string fields: shopDomain set to your-store.myshopify.com and apiVersion set to 2026-04. Keeping these in one place means you never hunt through a URL to change the version.
4. Add the HTTP Request node. Set method to GET and the URL to =https://{{ $json.shopDomain }}/admin/api/{{ $json.apiVersion }}/shop.json. Under Authentication choose Predefined Credential Type, then set the credential type to Shopify Access Token API and select the credential you made in step 1. This is the key move: the HTTP node reuses the Shopify credential and adds the auth header for you.
5. Make the request forgiving. In the HTTP node’s Options, add Response and turn on Full Response and Never Error. Full Response exposes the status code; Never Error stops a 401 from halting the run so your IF node can react to it.
6. Add the IF node named Auth OK? Set the condition to Number, left value ={{ $json.statusCode }}, operation equals, right value 200.
7. Wire the true branch to a Set node. Name it Healthy Summary and write one string field, for example =Shopify API OK — {{ $json.body.shop.name }} (plan: {{ $json.body.shop.plan_name }}). Send this to a log, a sheet, or nowhere; the point is a clean success record.
8. Wire the false branch to Telegram. Set the chat ID to your own and the text to something like =Shopify API auth failed — HTTP {{ $json.statusCode }}. Check the token, scopes, and API version. Save the workflow and toggle it Active.

Common mistakes

• Using a custom domain in the URL. The Admin API only answers on your-store.myshopify.com, never on your storefront domain. A request to the pretty domain returns 401 or 404.
• Missing scopes. A token is valid but scoped. If a workflow reads orders, the custom app needs read_orders; for products, read_products. The shop.json check works with a minimal token, so a health check can pass while a real workflow still 401s on a resource whose scope you forgot to grant.
• Confusing OAuth2 with the token method. Picking Shopify OAuth2 API for a store you own means running an install flow you do not need. For your own store, the access token credential is simpler and never expires.
• Leaving the API version stale. An old version in the URL keeps working until Shopify retires it, then every call fails at once. Pin a recent version like 2026-04 and bump it on a calendar reminder.
• Copying the token with a trailing space. A stray space or newline pasted into the credential is a classic silent 401. Retype the last character if a fresh token still fails.
• Not turning on Never Error. Without it, a 401 throws and the IF branch never runs, so your alert never fires and the failure stays invisible.

Cost at realistic volume

This one is close to free. The health check makes four API calls a day, about 120 a month, which is nothing against Shopify’s rate limit of two requests per second on the standard REST bucket. Telegram messaging is free. On self-hosted n8n your only cost is the server you already run. On n8n Cloud, four scheduled executions a day sit comfortably inside the Starter plan’s monthly execution allowance, so the marginal cost of running this is effectively zero. The token and the Shopify Admin API themselves cost nothing on any Shopify plan.

Frequently asked questions

Related guides

• How to connect Shopify to n8n in 2026 — the prerequisite connection walkthrough.
• n8n Shopify automation hub — every workflow that runs on this same credential.
• All Shopify automation guides — the full library.
• All ready-to-import n8n templates