storefront-api

When to Use Storefront API

Use Storefront API for customer-facing applications:

• Building custom storefronts (headless commerce)
• Shopping cart and checkout flows
• Product browsing and search
• Customer account management (orders, addresses)
• Subscription management
• Market-specific pricing and inventory (with Market directives)
• Cart line operations (add, remove, update)
• Customer authentication and profiles

DO NOT use for: store management, admin operations, or internal tools (use Admin API instead).

---

Token Types & Scopes

Public Access Tokens

Use for: Frontend applications, public data access

const publicToken = 'Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'; // Public token
const shopDomain = 'mystore.myshopify.com';
const endpoint = `https://${shopDomain}/api/2026-01/graphql.json`;

const headers = {
  'Content-Type': 'application/json',
  'X-Shopify-Storefront-Access-Token': publicToken,
};

Scopes enabled with public token:

• Read products
• Read product collections
• Read shop information
• Read customer information (requires customer login)
• Create shopping carts
• Manage shopping carts
• Access checkout URLs

Private Access Tokens (Storefront)

Use for: Backend/server-side access with elevated permissions

const privateToken = process.env.SHOPIFY_STOREFRONT_PRIVATE_TOKEN;

const headers = {
  'Content-Type': 'application/json',
  'X-Shopify-Storefront-Access-Token': privateToken,
};

Additional scopes with private token:

• Full customer account access
• All storefront operations
• No rate limiting (unlike public token: 2 requests/second per IP)

---

Headers & Configuration

Standard Storefront Headers:

const headers = {
  'Content-Type': 'application/json',
  'X-Shopify-Storefront-Access-Token': accessToken,
};

TypeScript Headers Interface:

interface StorefrontHeaders {
  'Content-Type': 'application/json';
  'X-Shopify-Storefront-Access-Token': string;
  'Accept-Language'?: string; // For locale-specific data
}