Shopify exposes several APIs, each designed for different integration patterns. Choosing the wrong one is a common source of wasted development time — a Storefront API token cannot access order history; an Admin API token should never be exposed to a browser. This guide clarifies which API to use, when, and why.
Shopify API Overview
| API | Access | Protocols | Typical Use Cases | Auth Method |
|---|---|---|---|---|
| Admin API | Private (server-side only) | REST + GraphQL | ERP sync, order management, fulfilment, customer data, custom apps | Admin API access token |
| Storefront API | Public (safe for browser/mobile) | GraphQL only | Headless storefronts, mobile apps, custom cart/checkout flows | Storefront access token |
| Partner API | Partner account only | GraphQL | Managing multiple stores, bulk operations, app reporting | Partner API client credentials |
| Payments Platform API | Private | REST | Building custom payment providers | App credentials |
REST vs GraphQL: Which Should You Use?
Shopify has been progressively deprecating REST endpoints in favour of GraphQL. The Admin API’s REST interface still exists and is widely used, but Shopify’s stated direction is GraphQL-first. New integrations should use GraphQL where possible. The practical advantages: you fetch exactly the fields you need (reducing response payload), you can batch multiple queries in one request, and you get strongly typed schemas with introspection.
For teams less experienced with GraphQL, REST remains viable for most Admin API operations in 2026 — but plan for migration effort as Shopify continues to sunset specific REST endpoints.
Rate Limits by Plan
Shopify uses a leaky-bucket rate limiting model for Admin API. Each request consumes from a bucket, which refills at a steady rate. The bucket size and refill rate differ by plan:
- Basic / Shopify / Advanced: 40 requests per bucket, refills at 2/second
- Shopify Plus: 80 requests per bucket, refills at 4/second
For GraphQL, Shopify uses a cost-based system where complex queries cost more points than simple ones. Bulk operations (via bulkOperationRunQuery) bypass standard rate limits and are the correct approach for large data exports or mass updates.
When to Use Shopify Functions
Shopify Functions are not an API in the traditional sense — they are server-side logic that runs within Shopify’s infrastructure to customise discount calculations, shipping rate filtering, payment method visibility, and cart transformations. Use Functions when you need to customise these commerce primitives in ways the standard API does not allow. Functions are available on all plans and are the recommended replacement for Script Editor.
For custom app development using Shopify APIs, OneOnic’s Shopify development team builds integrations across Admin API, Storefront API, and Functions, with rate limit handling and webhook reliability built in.
Authentication Basics
The Admin API uses OAuth 2.0 for public apps (where other merchants install your app) or simple API access tokens for custom private apps. The Storefront API uses a public storefront access token that is safe to include in client-side code — it only has access to publicly available product, collection, and cart data. Never expose an Admin API token in a browser or mobile app; it provides write access to your entire store.
Frequently Asked Questions
Can I use the Shopify Admin API from a mobile app?
You should not. Admin API tokens must be kept secret and should only be used in server-side environments. For mobile apps that need product data, cart functionality, and checkout, use the Storefront API — it is designed for public client access and does not expose sensitive store data or allow destructive operations.
What is the difference between a custom app and a public Shopify app?
A custom app is built for a single specific store and installed directly via the Shopify admin using an access token. A public app is listed on (or distributed via) the Shopify App Store and can be installed by any merchant via OAuth. Custom apps are simpler to build and deploy but cannot be distributed to other merchants. Public apps require OAuth implementation and app review approval.
How do Shopify webhooks work?
Webhooks allow Shopify to send real-time HTTP POST notifications to your endpoint when events occur (order created, product updated, customer data request for GDPR compliance, etc.). They are configured via the Admin API or in the Partner Dashboard. Your endpoint must respond with HTTP 200 within five seconds or Shopify will retry. For high-volume webhooks, use event queuing (SQS, Redis, etc.) rather than processing synchronously in the webhook handler.
Ready to Grow Your Shopify Store?
Our Shopify experts at OneOnic have helped hundreds of brands launch, optimise, and scale. Let’s talk about your project.
