Create a Shopify Custom App in the Dev Dashboard (2026 Guide)

For years, getting API access to your own Shopify store was a few clicks in the admin: create an app under Develop apps, tick some scopes, copy a token. That path is closed for new apps. Custom apps are now created in the Dev Dashboard or with Shopify CLI, tokens are fetched by code rather than copied from a screen, and the app belongs to an organization.

This guide explains how the new setup works, what happens to apps you already have, and the ownership questions to settle before anyone writes code.

What changed

Shopify’s help center on custom apps says it plainly: “You create and manage custom apps using the Dev Dashboard.” Custom apps created before January 1, 2026 are legacy apps, and you still manage them from your Shopify admin.

The developer docs on admin-created custom apps add the key points:

You can no longer create new admin-created custom apps.
Existing apps are unaffected and continue to work.
For new apps, use the Dev Dashboard or Shopify CLI.

	Legacy admin-created app	Dev Dashboard or CLI app
Created	In the Shopify admin, before January 1, 2026	In the Dev Dashboard or with Shopify CLI
Managed	In the Shopify admin	In the Dev Dashboard
Access token	Shown once in the admin	Fetched by code with an OAuth grant
Rotating credentials	API key and secret cannot be rotated	Client secret can be rotated
Scope changes	Edited on the app in the admin	New app version, approved on the store

Who can create a custom app

According to Shopify’s help center, store owners automatically have full access to create and manage custom apps. Staff members need the App development > Develop permission. Collaborator accounts cannot access the Dev Dashboard, because they do not have organization-level permissions. That last point matters if your developer or agency has been working in your store as a collaborator: they cannot create the app for you that way.

The Dev Dashboard permissions are role-based. A merchant user gets access through the App developer role, and on Shopify Plus a custom role can include “Build and manage apps” for apps owned by the organization.

Two ways to build: Dev Dashboard or Shopify CLI

The Dev Dashboard lives at dev.shopify.com, and you can reach it from your admin under Settings > Apps > Develop apps > Build apps in Dev Dashboard. Apps made in the dashboard and apps made with Shopify CLI appear in the same list. Shopify suggests:

The Dev Dashboard for automation or API-only apps with no screens in the Shopify admin, such as a sync job or an export script.
Shopify CLI for feature-rich apps with their own admin screens or extensions.

With the CLI, the app’s settings live in a shopify.app.toml file in the code: the client_id, the access scopes under [access_scopes], and the webhook api_version, as described in Shopify’s app configuration docs. Running shopify app deploy releases a new app version. Releasing a version in the Dev Dashboard does the same thing as shopify app release.

Creating an app in the Dev Dashboard, step by step

Shopify’s guides to creating apps in the Dev Dashboard and installing a custom app describe the flow:

Create the app. In the Dev Dashboard, open Apps, select Create app, choose Start from Dev Dashboard, and name it.
Create a version. A version is a snapshot of the app’s configuration. Set the App URL; if the app has no screens in the admin, Shopify lets you use the default URL https://shopify.dev/apps/default-app-home. Choose a Webhooks API version.
Set the access scopes. In the Access section, enter the scopes the app needs.
Release. Select Release, optionally with a version name and message.
Install. In the Installs section, select Install app, choose the store, and approve the install.

You need at least one released version before the app can be installed.

Access scopes: ask for less

Scopes decide what the app can read and change: read_orders, write_products, and so on. Shopify’s GraphQL Admin API docs put it simply: only request as much data access as your app needs to work. For a custom app, that also keeps the damage small if a credential ever leaks.

Two rules to know:

Scope changes need approval. When a new version changes scopes, the merchant must approve them manually in the Shopify admin. Plan that step into any release that adds a scope.
Protected customer data needs approval. Access to protected customer fields goes through Shopify’s protected customer data process, and the help center notes that a custom app with Level 2 personal data access requires the store to be on the Grow plan or higher.

Access tokens: fetched, not copied

This is the change that surprises most owners. With a Dev Dashboard app, you cannot copy an access token from the Shopify admin. The help center says the developer has to generate one with code, using the app’s client ID and client secret.

Shopify’s guide to getting API access tokens for Dev Dashboard apps describes three grants:

Grant	When it fits
Client credentials	Server-side apps acting on stores in your own organization
Token exchange	Stores that install through custom distribution, when the app runs inside the Shopify admin
Authorization code	Stores that install through custom distribution, when the app runs outside the Shopify admin

For a back-office script on your own store, the client credentials grant is the simple one:

POST https://{shop}.myshopify.com/admin/oauth/access_token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={client_id}&client_secret={client_secret}

The response contains access_token, scope and expires_in. Two details matter:

The token expires after 24 hours. Your code should cache it and request a new one before it expires, not store it once in a config file.
It only works within one organization. The client credentials grant works only when the app and the store belong to the same Shopify organization. Owning or installing a store does not put it in your organization on its own, and the grant cannot reach a client’s store.

The token then goes in the X-Shopify-Access-Token header on Admin API calls, exactly as before.

Installing on more than one store

Shopify’s distribution docs say a custom app can be installed on a single store, on several stores in the same Plus organization, or on development stores. Custom apps skip App Store review and cannot charge through Shopify’s app billing. You cannot change the distribution method after you choose it, so decide early whether the app is only ever for your stores.

Within your organization, the help center says you can share the app’s install link to install it on other stores.

Who owns the app and its credentials

In the Dev Dashboard, apps belong to the organization. That makes ownership a question to settle on day one:

Create the app in your own organization where you can, and give your developer the access they need there. If a developer creates it in theirs, the app, its client secret and its settings sit in an account you do not control.
Keep the client secret in a place you control, such as your hosting provider’s secret store, not in the code or a shared document.
Know who can rotate it. Shopify recommends rotating the client secret if it was exposed, if someone with access left your organization, or as regular hygiene. In the Dev Dashboard, open the app’s Settings, rotate the secret under Credentials, update the app and every stored token, and only then revoke the old secret. Revoking early cuts off access.
Check the contact addresses. Shopify sends webhook failure warnings to the app’s emergency developer email, and announces deprecations through emergency developer contact notifications. Make sure those addresses reach someone on your side.

Our guide to maintaining a custom Shopify app has a full handover checklist for when a developer or agency changes.

What to do with an existing admin-created app

If it works, you do not have to touch it today. Existing apps continue to work. But know its limits:

Do not delete it to make room. Shopify warns that deletion is permanent and you cannot create a new admin-created app to replace it. Build the replacement first, run it, then remove the old one.
The token is shown once. If it was never stored safely, you can only get a new one by uninstalling and reinstalling the app, and its requests and webhooks break until the code uses the new token.
Credentials cannot be rotated. The API key and secret of an admin-created app cannot be rotated.
It still needs upkeep. API versions still expire. Run our API version upgrade checklist, and if the app still calls the REST Admin API, plan the REST to GraphQL migration at the same time as any move to the Dev Dashboard.

Before you build anything

Check whether you need a custom app at all. Many jobs fit Shopify Flow or an existing app, and when to build a custom Shopify app walks through the choice.

Having it set up for you

If you would rather have someone set up the app, the tokens and the hosting while you keep ownership, our custom solutions page describes the Shopify work we take on, by the same team that builds and runs Storefleet Store Ops. How to brief a developer lists what to have ready.

FAQ

Can I still create a custom app in the Shopify admin?

No. New custom apps are created in the Dev Dashboard or with Shopify CLI. Apps created in the admin before January 1, 2026 keep working and are managed as legacy custom apps.

Where do I find the Admin API access token for a Dev Dashboard app?

You don’t copy it from a screen. The app’s code requests a token with its client ID and client secret, for example through the client credentials grant, which returns a token valid for 24 hours.

Can my agency create the custom app as a collaborator?

Not through a collaborator account. Shopify’s help center says collaborators cannot access the Dev Dashboard. Give them the access they need in your organization, or agree in writing who owns the app if it lives in theirs.

Should I delete my old admin-created custom app?

Not until its replacement is running. Deletion is permanent and you cannot create a new admin-created app to replace it.

Can one custom app run on several of my stores?

Yes, if the stores belong to the same Plus organization. Otherwise a custom app is installed on a single store or on development stores.