Oauth access-tokens admin-api troubleshooting

Authentication & Access
,
1

I’ve wasted so many hours trying to connect LetaiDo.com to shopify that I can’t stop (sunk cost fallacy).

That ai engine gave me this to post. Can anyone help me out here?

Admin API returns 401 for a valid offline token; app Logs show zero API activity

Store: the-virtual-foundry.myshopify.com
App: TVF SEO Agent
Client ID: d8e59f725c7ca965ddd0320a40b9d5dd
Org ID: 224241268
App ID: 410493157377
Failing x-request-id: 8392ed72-4793-4e13-b65b-f3c184a410a8-1786677870

Summary
A Dev Dashboard app with Custom distribution is installed on our store. The
authorization_code grant completes successfully and returns an offline access
token (shpca_…) with the correct scopes. Every Admin API call using that token
returns 401 “[API] Invalid API key or access token (unrecognized login or wrong
password)” - including /admin/oauth/access_scopes.json. The app’s Logs page in
the Dev Dashboard shows “No logs found”, i.e. Shopify records no API activity at
all for these requests.

Scopes granted (confirmed in the token response):
write_products, write_content, write_online_store_pages,
read_online_store_navigation, read_themes, write_files

Verified on our side

  • App shows as Installed in store admin, with Edit permissions on Products,
    Online Store, and Shopify admin.
  • Client ID and secret in our config match the Dev Dashboard exactly.
  • App URL is a live endpoint that handles Shopify’s OAuth initiation call and
    redirects into /admin/oauth/authorize (an earlier placeholder App URL was the
    cause of a previous failure and has been fixed).
  • Reinstalled and re-authorized after the fix; a new token was issued.
  • 401 reproduces from two unrelated networks and on REST, GraphQL, and
    access_scopes, across API versions 2024-10, 2025-01, 2025-10 and 2026-07.
  • client_credentials grant returns shop_not_permitted (store is not in the same
    org; org verification is pending), so authorization_code is the only path.

Question
Why is an offline token issued by a successful authorization_code grant not
recognized by the Admin API, and why does the app’s Logs page record no requests?