It’s never completely safe. If you have doubts, Shoffi considered “safe” got tokens leaked recently: The Shoffi Partner Token Leak · Very Bad Panda
Not whole access, but worth knowing what you’re giving. You create a Partner API client in your Partners dashboard and choose the permissions (e.g, view financials, manage apps, and manage themes). That covers app events (installs, uninstalls, charges) and transaction data across your Partner org. It can’t read merchant store data like orders or customers.
You can rotate or delete the token anytime from the Partners dashboard.
That’s fair, and it’s a real gap on Shopify’s side. There’s no read-only Partner API key, so any tool you connect gets more than it needs.
Best you can do is grant only the permissions required, rotate the token, and delete the client when you stop using it. If you’d rather not share a key at all, logging installs/uninstalls through your own webhooks is the zero-trust option.
def not safe, never hand out a read/write partner token. it would be a very bad idea, just as bad as linking a read/write partner token to a third party CI system
By the way, if you’re not aware of it, I’d like to draw your attention on the view financials permission, which is giving write permissions, unlike the name suggests: Partner API reference
Thanks for flagging this, you’re right. Shopify should split read and write here.
There is a https://dev.shopify.com/dashboard/PARTNER_ID/apps page that shows install count based on the new algorithm but this has usability issues:
- It constantly has to be refreshed due to “Session token invalid” or similar error —offline token migration preview? Yay
- When you click on a particular app, then the install count, you can see the install list but, unlike the old, beloved partner dashboard page, you can’t easily get the shop’s actions install/uninstall/subscribe/cancel etc…
sigh