Shopify

What it is

Shopify runs online stores and many shop tills: products, stock, orders, returns, customers and, on some plans, wholesale (B2B) ordering.

How an agent connects

1. The GraphQL Admin API. This is the route for a merchant's own data. An app signs in with OAuth and asks only for the scopes it needs, such as reading orders or writing products. For a server-side integration that acts only on the business's own store, Shopify documents a client credentials grant. Store-admin "custom apps" are legacy and can no longer be created.
2. Exports. Orders export to CSV from the admin; large exports arrive by email.
3. Automation platforms. Zapier has a Shopify app, and n8n has Shopify and Shopify Trigger nodes.

Shopify's own MCP servers do not reach store admin data. The Dev MCP server covers docs and API schemas, and the storefront servers act for shoppers (catalogue, cart, checkout). So official_mcp is none for this job. Community Admin servers exist but none comes from a known organisation; do not use them for client data.

What agents may do

Draft (agent_access: draft). The agent reads products, orders, returns, inventory and B2B companies. It may save products as drafts and prepare return decisions and replies. A person publishes products, approves or declines returns, issues refunds and changes prices.

Through the gateway

The app's token is held by the gateway, never in a prompt or file. Reads are logged. Saving a draft product is held for the owner while the agent rehearses. Customer replies are drafts held for approval. Refunds, cancellations, price changes and B2B payment terms are never automated.

Watch out for

• Use GraphQL, not REST. The REST Admin API is legacy, and new public apps must use GraphQL. Avoid servers and samples built on REST.
• Rate limits by cost. Queries cost points that refill at a rate set by plan; one query may not exceed a stated maximum cost. Ask only for the fields you need and page through results.
• Least scopes. A token with write scopes can change the live store. Request read scopes plus product drafts only.
• Customer data. Names, addresses and order history stay in the store and the gateway log.
• B2B is plan-locked. Check the plan before promising a wholesale portal.