Shopify Authentication Guide - June 2026

Introduction

Before you begin

The objective of this guide will be to create a custom app in Shopify, install it into your live Shopify shop, grant it access to the Shopify API and then generate an access token that Khaos Control can use perform actions against the Shopify shop.

To achieve this, you will need admin access to your Shopify shop.

This guide is split into 4 sections where you will learn how to:

1. create the custom app in Shopify
2. install the custom app to your Shopify shop
3. authorise the custom app
4. use the authorisation code to generate an access token

Create the custom app in Shopify

Open a new browser window and login to your Shopify Shop here:

https://www.shopify.com/uk/store-login

You should see the current shop selected at the top-right. Make sure you are in the correct shop before proceeding, otherwise Khaos Control will be installed to the wrong shop!

In the same browser window, in a new tab, log into the Shopify Developer Dashboard here:

https://dev.shopify.com/dashboard/

You will see a mostly empty Dev Dashboard page with some options on the left for Apps, Dev Stores etc.

Click on Apps and then Create app at the top right of the page

In the next page, enter an App name in the Start from Dev Dashboard section on the right, then click Create to continue.

After a few seconds you will be redirected to the Create Version page.

Now you will need provide some settings for the new app. Simply copy and paste the following information over to their relevant fields:

App URL:

https://khaoscontrol.com

Redirect URLs:

https://oauth.khaoscontrol.com

Scopes:

write_content, write_customers, write_orders, write_products, write_translations, write_third_party_fulfillment_orders, write_themes, read_shopify_payments_payouts, read_shopify_payments_disputes, read_shopify_payments_bank_accounts, read_shopify_payments_accounts, write_shipping, write_script_tags, write_resource_feedbacks, write_reports, write_product_listings, write_price_rules, write_order_edits, write_online_store_pages, write_merchant_managed_fulfillment_orders, write_marketing_events, read_locations, write_locales, write_inventory, write_gift_cards, write_fulfillments, write_draft_orders, write_discounts, write_assigned_fulfillment_orders, read_analytics, read_content, read_customers, read_orders, read_products, read_translations, read_third_party_fulfillment_orders, read_themes, read_shipping, read_script_tags, read_resource_feedbacks, read_reports, read_product_listings, read_price_rules, read_order_edits, read_online_store_pages, read_merchant_managed_fulfillment_orders, read_marketing_events, read_locales, read_inventory, read_gift_cards, read_fulfillments, read_draft_orders, read_discounts, read_assigned_fulfillment_order

The end result will look something like this:

Now click Release at the bottom of the page.

You will be prompted to enter a version name and message. These are optional and it's fine to just leave them empty and then click Release again.

You will be redirected back to the Versions page and should see the app versions listed. The most recent one will be flagged as Active in the list

From the options on the left, click Settings to view the app settings.

Copy the Client ID and Secret from here and keep them for future use.

Install the app to your Shopify shop

Still in the Shopify developer dashboard, click on the app name at the top of the navigation tree.

Then in the page that opens, click on Install App.

It will redirect you to a page where you will be prompted to select the Shopify Store in which to install the app.

Select the appropriate store and click Install. After a short wait, you will be redirected to your Shopify Shop and will see the Khaos Control homepage open on the right.

Authorise the app

To initialise the authorisation process, you will need to visit a specific URL following this template:

https://{shop}/admin/oauth/authorize?client_id={client_id}&redirect_uri=https://oauth.khaoscontrol.com&state={state}&grant_options[]=

• replace {shop} with the shop name as it appears in URLs

• replace {client_id} with the client ID you copied from the Shopify app settings page earlier

• replace {state} with some random letters or a password and make a note of it for later - we will need it in the next stage.

If you're not sure how to find the correct shop name, go to the Shopify admin homepage and check what is displayed in the URL. You need to include any trailing numbers.

In this example, the shop is named Badger's Emporium and the shop name as it appears in the URL is badgers-emporium-2.

The full URL that you need for authorisation will look something like this:

https://badgers-emporium-2.myshopify.com/admin/oauth/authorize?client_id=a04155eabd5387eb5151c73add7da86d&redirect_uri=https://oauth.khaoscontrol.com&state=rsgdrqgz&grant_options[]=

Copy this URL and paste it into you browser (in the same window as before)

You will once again be asked to approve the application. After you approve it here, you will be redirected to a page displaying the authorisation code.

Take a copy of the code - we will need it for the next and final stage.

As an additional security precaution, you can check that the state displayed in the URL of this page matches the state you specified earlier.

Generate the access token

Now that you have created the app, installed it and authorised it to access your shop, we need to generate an access token that Khaos Control can use to access the API directly.

This will be achieved using a single PowerShell command.

Open a PowerShell window and copy of the following command with the placeholders replaced:

curl.exe -X POST `

"https://{shop}.myshopify.com/admin/oauth/access_token" `

-H "Content-Type: application/x-www-form-urlencoded" `

-d "client_id={client_id}" `

-d "client_secret={client_secret}" `

-d "code={auth_code}

• replace {shop} with the shop name as it appears in URLs

• replace {client_id} with the client ID copied from the Shopify App Settings page

• replace {client_secret} with the client secret copied from the Shopify App Settings page

• replace {auth_code} with the code copied in the previous step

The full command will look something like this:

curl -X POST `

"https://badgers-emporium-2.myshopify.com/admin/oauth/access_token" `

-H "Content-Type: application/x-www-form-urlencoded" `

-d "client_id=a04155eabd5387eb5151c73add7da86d" `

-d "client_secret=shpss_redactedsecret123456" `

-d "code=436ac50ddc28cd956e208fe29588c4de"

After you input this command into PowerShell and press return, you should get a response containing the access token and a list of the scopes that we configured for application in the first stage.

{"access_token":"shpat_redactedaccesstoken123456","scope":"read_analytics,write_assigned_fulfillment_orders,write_customers,write_price_rules,write_discounts,write_draft_orders,write_fulfillments,write_gift_cards,write_inventory,write_locales,read_locations,write_marketing_events,write_merchant_managed_fulfillment_orders,write_online_store_pages,write_order_edits,write_orders,write_product_listings,write_products,write_reports,write_resource_feedbacks,write_script_tags,write_shipping,read_shopify_payments_accounts,read_shopify_payments_payouts,read_shopify_payments_bank_accounts,read_shopify_payments_disputes,write_content,write_themes,write_third_party_fulfillment_orders,write_translations"}

Make a copy of the access token, which is the string of characters in quotes near the start of the response - in this example:

shpat_redactedaccesstoken123456

Now that you have the access token, you can add or edit the Shopify channel in Khaos Control and set this access token in the channel configuration page.