shopify-setup
This skill automates Shopify CLI installation, store authentication, custom app creation, and Admin API token configuration. Use it when setting up Shopify API access for the first time, installing or troubleshooting Shopify CLI, creating authentication credentials for product or content management, or verifying that an existing API connection is functional.
git clone --depth 1 https://github.com/jezweb/claude-skills /tmp/shopify-setup && cp -r /tmp/shopify-setup/plugins/shopify/skills/shopify-setup ~/.claude/skills/shopify-setupSKILL.md
# Shopify Setup
Set up working Shopify CLI authentication and Admin API access for a store. Produces a verified API connection ready for product and content management.
## Workflow
### Step 1: Check Prerequisites
Verify the Shopify CLI is installed:
```bash
shopify version
```
If not installed:
```bash
npm install -g @shopify/cli
```
### Step 2: Authenticate with the Store
```bash
shopify auth login --store mystore.myshopify.com
```
This opens a browser for OAuth. The user must be a store owner or staff member with appropriate permissions.
After login, verify:
```bash
shopify store info
```
### Step 3: Create a Custom App for API Access
Custom apps provide stable Admin API access tokens (unlike CLI session tokens which expire).
**Check if an app already exists**: Ask the user if they have a custom app set up. If yes, skip to Step 4.
**If no custom app exists**, guide the user through creation via browser:
1. Navigate to `https://{store}.myshopify.com/admin/settings/apps/development`
2. Click **Create an app**
3. Name it (e.g. "Claude Code Integration")
4. Click **Configure Admin API scopes**
5. Enable these scopes (see `references/api-scopes.md` for details):
- `read_products`, `write_products`
- `read_content`, `write_content`
- `read_product_listings`
- `read_inventory`, `write_inventory`
- `read_files`, `write_files`
6. Click **Save** then **Install app**
7. Copy the **Admin API access token** (shown only once)
Use browser automation (Chrome MCP or playwright-cli) if the user prefers assistance navigating the admin.
### Step 4: Store the Access Token
Store the token securely. Never commit it to git.
**For project use** — create `.dev.vars`:
```
SHOPIFY_STORE=mystore.myshopify.com
SHOPIFY_ACCESS_TOKEN=shpat_xxxxxxxxxxxxxxxxxxxxx
```
Ensure `.dev.vars` is in `.gitignore`.
**For cross-project use** — store in your preferred secrets manager (environment variable, 1Password CLI, etc.).
### Step 5: Verify API Access
Test the connection with a simple GraphQL query:
```bash
curl -s https://{store}.myshopify.com/admin/api/2025-01/graphql.json \
-H "Content-Type: application/json" \
-H "X-Shopify-Access-Token: {token}" \
-d '{"query": "{ shop { name primaryDomain { url } } }"}' | jq .
```
Expected response includes the shop name and domain. If you get a 401, the token is invalid or expired — recreate the app.
### Step 6: Save Store Config
Create a `shopify.config.json` in the project root for other skills to reference:
```json
{
"store": "mystore.myshopify.com",
"apiVersion": "2025-01",
"tokenSource": ".dev.vars"
}
```
---
## Critical Patterns
### API Version
Always specify an explicit API version (e.g. `2025-01`). Using `unstable` in production will break without warning. Shopify retires API versions quarterly.
### Token Types
| Token | Format | Use |
|-------|--------|-----|
| Admin API access token | `shpat_*` | Custom apps — stable, long-lived |
| CLI session token | Short-lived | Shopify CLI commands only |
| Storefront API token | `shpca_*` | Public storefront queries |
This skill sets up **Admin API access tokens** — the right choice for product and content management.
### Rate Limits
Shopify uses a leaky bucket rate limiter:
- **REST**: 40 requests/second burst, 2/second sustained
- **GraphQL**: 1,000 cost points per second, max 2,000 points per query
For bulk operations, use the `bulkOperationRunQuery` mutation instead of looping.
---
## Reference Files
- `references/api-scopes.md` — Admin API scopes needed for product and content managementGenerate AI images using Gemini or GPT APIs directly. Covers model selection (Gemini for scenes; GPT Image 2 for text rendering, batch variations, multi-reference compositing; GPT Image 1.5 for transparent icons), the 5-part prompting framework, API calling patterns, multi-turn editing, and quality assurance. Produces photorealistic scenes, icons, illustrations, OG images, posters, infographics, and product shots. Use when building websites that need images, creating marketing assets, or generating visual content. Triggers: 'generate image', 'ai image', 'create hero image', 'make an icon', 'generate illustration', 'create og image', 'poster', 'infographic', 'image variations', 'gpt-image-2', 'ai art', 'image generation'.
Generate complete user documentation for a web app with screenshots. Browses the app via browser automation, screenshots every screen, and produces a structured user guide with step-by-step instructions, annotated screenshots, workflow diagrams, and reference tables. Supports quick (key screens), standard (all pages), thorough (every state and flow), and exhaustive (publishable documentation suite). Triggers: 'document the app', 'user guide', 'app documentation', 'screenshot docs', 'generate user docs', 'help docs', 'how-to guide', 'write the docs'.
Australian business English for professional writing — warm, direct, EN-AU spelling (colour, organise, centre), no filler words. Use whenever the user is writing for an Australian audience: emails, chat messages, proposals, client communications, blog posts, web copy, or any business writing. Apply to drafting, editing, and tone-checking professional text.
Write compelling award submissions, grant applications, and competition entries. Maps achievements to selection criteria using evidence-based narratives. Use whenever the user is applying for a business award (Telstra, chamber of commerce, industry awards), a grant, a competition, or any submission demonstrating merit against defined criteria.
Get a second opinion from leading AI models on code, architecture, strategy, prompting, or anything. Queries models via OpenRouter, Gemini, or OpenAI APIs. Supports single opinion, multi-model consensus, and devil's advocate patterns. Use whenever the user says 'brains trust', 'second opinion', 'ask gemini', 'ask gpt', 'peer review', 'consult another model', 'challenge this', or 'devil's advocate'.
Hit the Cloudflare REST API directly for operations that wrangler and MCP can't handle well. Bulk DNS, custom hostnames, email routing, cache purge, WAF rules, redirect rules, zone settings, Worker routes, D1 cross-database queries, R2 bulk operations, KV bulk read/write, Vectorize queries, Queues, and fleet-wide resource audits. Produces curl commands or scripts. Triggers: 'cloudflare api', 'bulk dns', 'custom hostname', 'email routing', 'cache purge', 'waf rule', 'd1 query', 'r2 bucket', 'kv bulk', 'vectorize query', 'audit resources', 'fleet operation'.
Scaffold and deploy Cloudflare Workers with Hono routing, Vite plugin, and Static Assets. Describe project, scaffold structure, configure bindings, deploy. Use whenever the user wants to create a Worker project, set up Hono on Cloudflare, configure D1 / R2 / KV / Queues bindings, or troubleshoot Worker export syntax, API route conflicts, HMR issues, or deployment failures.
Run an independent code review using the OpenAI Codex CLI in headless mode. Gets a second opinion from a different model family (the current Codex models) on recent changes, a PR, a commit, or the whole app — covering bugs, regressions, security, data consistency, UX/state bugs, performance risks, and testing gaps. Saves a severity-prioritised report to .jez/reviews/. Triggers: 'codex review', 'review with codex', 'independent code review', 'what does codex think', 'get codex to review'.