We have an integration from Shopify using the shopify admin api. The integration connects to Shopify using basic auth. The end user reported that the orders which the integration pulls from Shopify did not appear in their ERP system. We looked at the log and the issue was a 403 error. The user reported to their shopify agency, who contact shopify developer support. We have had a call logged for a while, but have yet to resolve the issue. Shopify admin api 403 error in SOP import (see ticket from Shopify support) 60666537. I will continue to work with shopify DEV support. We have had the integration in place since 2021. The 403 issue occured in early October. So, just wanted to post on the community site to see if any other developers have had any recent 403 issues. I have reproduced the 403 issue on our shopify DEV site.
Hey @Developer_Rh 
- thanks for reaching out. 403 errors in a Shopify API context usually pop up due to insufficient permissions in an app’s configuration. If you’re able to share an X-Request-ID from the API response headers we send out for every API call, I can definitely take a look into this on our end for you. We have a list of common errors here in our dev docs that might help:
Usually, this is causedby the app’s scopes not reflecting the ones required by resource that’s been called by the API call. If you’re able to share that request ID here I can confirm the exact cause of the error though.
Hope this helps, let me know if I can assist further!
Thanks Alan. We get an error 403 when authenticating, so no “X-Request-ID“. I was using the candidate release. I then used version 2025-10 and the call worked. So, it may be an issue with the candidate release of the shopify admin api
Thanks for following up @Developer_Rh , glad to hear this is working for you now. If you’d still like me to help with investigating the issue with the candidate release, would you be able to share the full endpoint URL you were using when you encountered the 403 error?
This would help us identify if there’s a specific bug or breaking change in the RC version that needs addressing. Usually an RC/unstable API call would look something like this:
https://{shop}.myshopify.com/admin/api/unstable/graphql.json
Let me know if you’d like us to dig into this further!
Hi Alan, we used the “orders” endpoint on are windows executable which calls the shopify admin api (json). We added the 2025-10 version to the URL (which is now working for the end user on their production site)
19/10/2025 11:27:13 RhS200{Shop}SopImportXML 2017.0.2.5 - Invalid Shopify API Web Shop, GetJsonString(https:// Api :shpat_@ site .myshopify.com/admin/orders.json?limit=10) Err ‘GetCredentias()’ The remote server returned an error: (403) Forbidden.
19/10/2025 11:27:13 No email sent.
I’ll review next month with the end user. The business impact of the issue was significant. The end user messaged shopify support a week ago with this comment :
“I want to clarify that this is now business critical that we have this resolved in a matter of days, it has been on going for 3 weeks and we are about to enter our busiest trading period. We have stock issues as we do not have the live feed into SAGE from Shopify, we also have had to switch off our ship from store option for online sales which is resulting in lost revenue. I would appreciate that this is treated with the highest priority and that a solution is found immediately as this is not acceptable and I am losing confidence very quickly.”
Thanks for following up @Developer_Rh , glad to hear this is working and thanks for sharing your client’s feedback. I’ll log this in our records for the initial ticket your client raised with us as well, just for context on our end.
Let me know if I can help with anything else on our end here.