Bot orders attributed to our app via its public Storefront API token

Dev Platform
1

We run a public Shopify app that uses the Storefront API to read product, collection, and variant metafield data.

For each merchant store, our app creates a Storefront API token using storefrontAccessTokenCreate. Because Storefront API tokens are public by design, this token is exposed on the storefront and used by our frontend script.

Our script only performs read operations. It does not create carts, modify checkouts, or place orders.

The only unauthenticated Storefront API scopes requested by our app are:

  • unauthenticated_read_content

  • unauthenticated_read_product_listings

We do not request unauthenticated_write_checkouts.

However, some merchants have reported orders that they do not recognize. When we inspect these orders, we see that:

  • The Sales Channel is shown as our app.

  • The order’s sourceName is our app ID.

  • The checkout went through the merchant’s real payment gateway.

  • The payment authorization later expired.

  • The client IP address changes between orders.

Our current assumption is that a bot may be:

  1. Extracting the public Storefront API token from the storefront.

  2. Using that token to create a cart or start a checkout through Shopify’s Storefront API.

  3. Completing the checkout through the merchant’s actual checkout/payment flow.

Because the Storefront API token belongs to our app, Shopify appears to attribute the resulting order to our app’s sales channel, even though our application never created the cart, checkout, or order itself.

We have also been able to reproduce similar behavior on our development store, as shown in the attached image.

We would like to understand:

  1. Is this expected behavior for public Storefront API access tokens?

  2. How can a cart or checkout be created using this token if our app does not have unauthenticated_write_checkouts?

  3. Does this behavior have any impact or risk for the merchant’s store, such as payments, order data, analytics, or fraud metrics?

  4. Does it have any impact or risk for our app, especially regarding sales-channel attribution, Shopify App Store review, or potential policy violations?

  5. Is there a recommended way to prevent third parties from using our Storefront API token in this way while still allowing our storefront script to perform public read queries?

Screenshot 2026-09-28 at 14.34.48
Screenshot 2026-09-28 at 14.34.48635Ă—118 4.63 KB

2

Same is happening for us. A merchant reported that fake orders were created through our app. We were quite puzzled but came to the same conclusion as you - bots use our public token for cart creation on the Storefront API.

Quite unfortunate that those orders get attributed to us, when there is nothing we can do to stop them.

The Storefront API does not require a token for creating a cart, so I’m not exactly sure why they would need to scrape for a public token. Maybe it’s because those requests look less suspicious, so they tend to fly under the radar in fraud detection?

3

We’re also getting merchant questions about the same situation for our app. We use storefront access tokens but don’t touch anything cart/order related so there’s for sure no way these could be coming from normal app functionality.

4

Could someone from Shopify check this for us, please?

5

To expand on my previous comment: We are now getting deprecated API calls using our Storefront access token. This shows up in our Dev Dashboard as a warning that the app might be delisted. Anyone else getting this?

I’ll be reaching out to partner support to figure out what to do here.