Skip to content
Docs
E-commerce

Shopify

Let hires look up orders, shipping and tracking, customers and products in your Shopify store, tag orders and add notes, and be woken when orders change. Refunds stay with your team.

Explore 7 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.

With Shopify connected, a hire can:

  • list orders by status, payment, fulfilment or date, or by Shopify search words (a customer's email, a SKU, a tag),
  • read an order: what was bought, totals and refunds so far, payment and fulfilment, tracking numbers and links, the customer, the note and tags,
  • find customers and read one with their latest orders,
  • list products with their stock and prices,
  • tag an order (like needs-follow-up) and add a line to its note.

Money stays with your team

Hires can't refund, cancel, capture payments or edit orders: those aren't tools at all. When a hire thinks a refund or cancellation is due, it asks for your approval with the details, and someone on your team does it in Shopify.

New stores need a registered app, coming later

Since 1 January 2026, Shopify no longer lets stores create the admin custom apps (and their shpat_ token) that Roster used to connect with. New stores will connect through a registered Roster app, which isn't available yet. Stores that already have a custom app, or that make a Dev Dashboard app of their own as below, can connect today, and existing connections keep working.

1. Make an app for Roster in Shopify

Roster uses Shopify's Admin API through an app installed on your store. Either:

  • A Dev Dashboard app (for new setups): in Shopify's Dev Dashboard (the form in Roster links there too), in the same organization as your store, create an app, give it the scopes below, and install it on the store. Copy its Client ID and Client secret from its settings.
  • A custom app your store already has: in your store's admin, Settings → Apps → Develop apps. Shopify no longer lets stores make new ones, but existing ones keep working. Copy its Admin API access token (starts with shpat_).

Scopes: read_orders, read_customers and read_products; read_all_orders to see orders older than 60 days; and write_orders if hires should tag orders and add notes. Customer names, emails and phone numbers are protected data at Shopify: allow the app the customer fields hires should see.

2. Connect it in Roster

  1. Open Integrations → Tools → Add a tool, search for Shopify and choose it.
  2. How Roster signs in: A Dev Dashboard app (paste the client ID and secret), or A custom app's Admin API access token (paste the token).
  3. Store: your store's myshopify.com address, like bayt-studio.myshopify.com. It's shown under Settings → Domains; your own domain won't work here.
  4. Click Connect. Roster checks the app (or token) with your store, and the connection shows Connected as your store's name. If Shopify refuses it, Roster says so and saves nothing.

3. Give hires access

On the hire's Tools tab, click Give access on Shopify:

  • Read only: it can read orders, customers and products, and nothing else.
  • Read and write: it can also tag orders and add to their notes.
  • Customer details: Names, emails and phone numbers, or Names only to keep customers' contact details from it.
  • Tags it may add: leave it empty for any tag.

Watching orders

A hire's responsibility can watch Shopify: it's woken when an order is placed or changes (paid, fulfilled, refunded, cancelled), with the list. Checking costs nothing when nothing changed.

If something goes wrong

  • "The app isn't allowed this": the app is missing a scope, or access to a customer field. Add it in Shopify and install the app again.
  • "Didn't accept the connection's credential": the token was revoked, or the Dev Dashboard app isn't in the same organization as the store.
  • An old order can't be found: the app needs read_all_orders for orders older than 60 days.

Tools and permissions reference

This reference is built from the same definitions Roster uses to connect Shopify and give hires access. It updates with each release.

Authentication and requested permissions

The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.

API key or access token

The custom app's token, starting with shpat_ (API credentials tab).

For: How Roster signs in: A custom app's Admin API access token.

OAuth client credentials

The Dev Dashboard app's client ID and secret (Settings).

For: How Roster signs in: A Dev Dashboard app (client ID and secret).

When making a key, use these permissions from the connection guide:

  • read_orders
  • read_all_orders (orders older than 60 days)
  • read_customers
  • read_products
  • write_orders (for hires that tag or note orders)

Connection fields

Shopify connection fields
FieldWhat to provide
How Roster signs in
signIn
Optional		Use the value for your account or connection.

Choices: A Dev Dashboard app (client ID and secret) (app); A custom app's Admin API access token (token).

Starts with: app.

Admin API access token
token
Required · sealed secret		The custom app's token, starting with shpat_ (API credentials tab).

Shown when signIn: token.

Client ID
clientId
Optional		The Dev Dashboard app's client ID and secret (Settings).

Shown when signIn: app.

Client secret
clientSecret
Optional · sealed secret		Use the value for your account or connection.

Shown when signIn: app.

Store
shop
Required		Your store's myshopify.com address (Settings → Domains shows it), not your own domain.

Per-hire limits

Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.

Shopify per-hire limits
FieldWhat to provide
Customer details
customers
Optional		What it sees of your customers. Names only keeps emails and phone numbers from it.

Choices: Names, emails and phone numbers (full); Names only (names).

Starts with: full.

Tags it may add
tags
Optional		Order tags it may add. Leave empty for any.

Actions

7 actions: 5 only read and 2 change something. A read action may still need approval when your workspace or hire is set to ask. A locked approval requirement always applies.

7 of 7 actions. Open an action for its arguments and full input schema.

list_ordersRead only

Orders in the store, newest first: by status, payment, fulfilment, date, or Shopify search words (a customer's email, a SKU, a tag).

Approval: Uses your workspace and hire approval settings.

Arguments for list_orders
ArgumentTypeDetails
statusOptional"open" | "closed" | "cancelled" | "any"See input schema below.Default: "any"
paymentOptional"paid" | "pending" | "authorized" | "partially_paid" | "partially_refunded" | "refunded" | "voided" | "expired"See input schema below.
fulfilmentOptional"unfulfilled" | "partial" | "fulfilled" | "on_hold" | "scheduled" | "unshipped" | "shipped"See input schema below.
sinceOptionalstringonly orders made on or after this date
searchOptionalstringShopify search words, like email:layla@client.example or sku:MUG-1
limitOptionalintegerSee input schema below.Default: 20
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "status": {
      "default": "any",
      "type": "string",
      "enum": [
        "open",
        "closed",
        "cancelled",
        "any"
      ]
    },
    "payment": {
      "type": "string",
      "enum": [
        "paid",
        "pending",
        "authorized",
        "partially_paid",
        "partially_refunded",
        "refunded",
        "voided",
        "expired"
      ]
    },
    "fulfilment": {
      "type": "string",
      "enum": [
        "unfulfilled",
        "partial",
        "fulfilled",
        "on_hold",
        "scheduled",
        "unshipped",
        "shipped"
      ]
    },
    "since": {
      "description": "only orders made on or after this date",
      "type": "string",
      "format": "date",
      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$"
    },
    "search": {
      "description": "Shopify search words, like email:layla@client.example or sku:MUG-1",
      "type": "string",
      "maxLength": 200
    },
    "limit": {
      "default": 20,
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    }
  }
}
read_orderRead only

Read one order: what was bought, totals and refunds so far, payment and fulfilment, tracking numbers, the customer, its note and tags.

Approval: Uses your workspace and hire approval settings.

Arguments for read_order
ArgumentTypeDetails
orderRequiredstringthe order's name like #1001, or its ID
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "order": {
      "type": "string",
      "minLength": 1,
      "description": "the order's name like #1001, or its ID"
    }
  },
  "required": [
    "order"
  ]
}
find_customersRead only

Find customers by name, email or phone, with how many orders they've made and what they've spent.

Approval: Uses your workspace and hire approval settings.

Arguments for find_customers
ArgumentTypeDetails
searchRequiredstringSee input schema below.
limitOptionalintegerSee input schema below.Default: 10
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "search": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200
    },
    "limit": {
      "default": 10,
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    }
  },
  "required": [
    "search"
  ]
}
read_customerRead only

Read one customer, with their latest orders.

Approval: Uses your workspace and hire approval settings.

Arguments for read_customer
ArgumentTypeDetails
idRequiredstringthe customer's ID
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "minLength": 1,
      "description": "the customer's ID"
    }
  },
  "required": [
    "id"
  ]
}
list_productsRead only

Products in the store, with status, stock and variants' prices; by Shopify search words (title, SKU, vendor).

Approval: Uses your workspace and hire approval settings.

Arguments for list_products
ArgumentTypeDetails
searchOptionalstringSee input schema below.
statusOptional"active" | "draft" | "archived" | "any"See input schema below.Default: "active"
limitOptionalintegerSee input schema below.Default: 20
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "search": {
      "type": "string",
      "maxLength": 200
    },
    "status": {
      "default": "active",
      "type": "string",
      "enum": [
        "active",
        "draft",
        "archived",
        "any"
      ]
    },
    "limit": {
      "default": 20,
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    }
  }
}
tag_orderRead and write

Add tags to an order, for the team to filter by (like needs-follow-up). Changes nothing else.

Approval: Uses your workspace and hire approval settings.

Arguments for tag_order
ArgumentTypeDetails
orderRequiredstringthe order's name like #1001, or its ID
tagsRequiredstring[]See input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "order": {
      "type": "string",
      "minLength": 1,
      "description": "the order's name like #1001, or its ID"
    },
    "tags": {
      "minItems": 1,
      "maxItems": 10,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 40
      }
    }
  },
  "required": [
    "order",
    "tags"
  ]
}
note_orderRead and write

Add a line to an order's note, which the team sees in Shopify. What's there already stays.

Approval: Uses your workspace and hire approval settings.

Arguments for note_order
ArgumentTypeDetails
orderRequiredstringthe order's name like #1001, or its ID
textRequiredstringSee input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "order": {
      "type": "string",
      "minLength": 1,
      "description": "the order's name like #1001, or its ID"
    },
    "text": {
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    }
  },
  "required": [
    "order",
    "text"
  ]
}

Watches and incoming events

  • This integration supports a responsibility that watches for changes. The guide above explains what it checks and how to limit it.
  • No incoming webhook handler is declared for this integration.

Limits and troubleshooting

  • Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
  • Expired or revoked access: reconnect or replace the key on the connection.
  • Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
  • The action schema describes accepted inputs. It does not grant additional access or bypass approvals.

Service documentation · Integration source reference

Saleor

Open-source GraphQL commerce: orders, products and checkouts.

WooCommerce

Let hires look up orders, customers and products in your WooCommerce store, leave notes, move orders along, and ask before any refund.

On this page

1. Make an app for Roster in Shopify2. Connect it in Roster3. Give hires accessIf something goes wrongTools and permissions reference