storefrontAccessTokenCreate Access Denied

GraphQL Admin API Troubleshooting
1

I’m using the storefrontAccessTokenCreate mutation from a public app. It is consistently returning Error: Access denied for storefrontAccessTokenCreate field. on my Shopify development store when I test it.

I see others having similar issues, and according to the linked forum post, the only way to have storefrontAccessTokenCreate work is by using/testing the app on a store with a paid Shopify plan (storefrontAccessTokenCreate doesn’t work on a development store). I’ve confirmed this with support.

How can I test my app that uses storefrontAccessTokenCreate without having to pay for a paid Shopify plan just to test?

3

Hi Suchir,

Digging into this - it does seem to be a limitation with how the storefrontAccessTokenCreate mutation operates. Is your app a sales channel?

4

By the way, if you’re using GraphQL Playground, you won’t be able to create a Storefront token with it. You’ll need to call the GraphQL API from somewhere else, like Postman or a server.

5

Just wanted to add that we’ve seen this in the past and it seemed to be random + intermittent. Have not seen this error for quite a while now!

6

@Liam-Shopify my app is not a sales channel, it is a public app.

As mentioned in the original post, I see this error consistently, not randomly/intermittently.

Also, i’m seeing this error in my development store when I do shopify app dev, not in the GraphQL playground.

What are my options here for getting access to a development store that does allow the storefrontAccessTokenCreate mutation?

7

@suchir as far as i know I don’t think it’s a development store issue, we have dev store and public apps and are able to create storefront token without any issue.

Can you share your access scopes please?

FYI - I have “Current release” dev store, if you are trying out with “Developer preview” stores, may be try creating new “Current release” dev store.

CleanShot 2025-03-06 at 10.50.51
CleanShot 2025-03-06 at 10.50.51992×872 72.5 KB

8

@Gulam_Hussain_Quinn thanks for the response! that’s interesting that you can create storefront token without issues on the dev store! I set up my dev store with the same exact options that you configured in the image you shared (including “Current release” for build version). I created my dev store February 11, 2025.

The scopes I have on my app is just “read_themes”. As far as I can tell from the docs page, this mutation should not require any access scopes. Which access scopes do you have?

9

We have these access

read_content, read_files, read_metaobject_definitions, read_metaobjects, read_orders, read_themes, unauthenticated_read_content, unauthenticated_read_metaobjects, unauthenticated_read_product_listings, write_content, write_files, write_metaobject_definitions, write_metaobjects, write_pixels, write_products
10

this worked @Gulam_Hussain_Quinn! I copied the scopes you’re using, redeployed my app using shopify app deploy and then i’m able to create the access token now. Thank you so much!

11

I think you only need unauthenticated access (e.g., unauthenticated_read_product_listings, etc.), as these permissions are required to use the Storefront API.

1 Like