Shopify MCP server for AI agents: Bearer token authentication
ShopMCP works with Claude, and also with n8n, Dify, Flowise, Langflow or your own agent. If your platform sends credentials as an HTTP header and cannot put a key in the URL, use the Authorization: Bearer setup below. No OAuth flow, three values to copy.
Quick setup: three values
In your agent platform, add a remote MCP server (HTTP / streamable HTTP) and enter:
| Server URL | https://www.shopmcp.net/mcp-shopify.ashx
Plain URL, no ?key= part. |
|---|
| Header name | Authorization |
|---|
| Header value | Bearer ACCOUNT_ID.KEY
Example: Bearer 1234.a1b2c3d4e5f6a1b2c3d4e5f6 |
|---|
Type the word Bearer and a space before the token.
If your platform has a built-in "Bearer token" option, it adds the word for you, so paste only ACCOUNT_ID.KEY. If it has a custom header form, paste the whole value including Bearer.
You do not need to build the value yourself. After installing ShopMCP, open MCP Settings and scroll to OPTIONAL: If you use Agent platform. It shows the server URL, header name and header value with a copy button for each.
Step by step
-
Install ShopMCP on your Shopify storeInstall the app from the Shopify App Store and open it from your Shopify admin.
-
Generate your MCP URLIn MCP Settings, click Generate MCP URL. This creates your private key.
-
Copy the agent platform valuesScroll to the agent platform section at the bottom of the page and copy the server URL, header name and header value.
-
Add the MCP server in your platformChoose no sign-in (or custom header) authentication, then paste the three values. Save and refresh the tool list.
-
Run shopify_preflight firstIt confirms which store the connection points to and that the permissions are in place before you ask the agent to change anything.
Test the connection
To check that header authentication works before configuring an agent, send a tool list request. In Windows PowerShell:
$h = @{ Authorization = "Bearer ACCOUNT_ID.KEY" }
$r = Invoke-RestMethod -Uri "https://www.shopmcp.net/mcp-shopify.ashx" -Method Post -Headers $h -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
$r.result.tools.Count
On macOS or Linux:
curl -X POST https://www.shopmcp.net/mcp-shopify.ashx \
-H "Authorization: Bearer ACCOUNT_ID.KEY" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
A list of tools means it works. A 401 Unauthorized means the account id or key is wrong, or the word Bearer is missing.
Why use a header instead of the URL
- Some platforms only inject credentials as headers. Their credential stores are built for
Authorization and API key headers, not for secrets inside a URL.
- Keys stay out of URLs. URLs are easy to end up in logs, screenshots and shared configs. A header value is kept in the platform's credential store.
- Nothing changes for Claude. The connector URL with the key still works exactly as before. Claude can also be connected with the header method if you prefer.
ShopMCP uses a static connector key rather than OAuth for the MCP connection. This keeps setup to a few copy and paste steps. Treat the key like a password and regenerate it from MCP Settings if it is ever exposed.
What your agent can do with ShopMCP
Once connected, the agent has access to more than 60 Shopify tools, including:
- Products, collections, variants, inventory and metafields
- Bulk price and stock updates
- Theme files, pages, blogs and navigation menus
- Discount codes and email campaigns
- Translations and market languages
- Image upload and generation
Delete operations are permanent. If you give an autonomous agent write access to a live store, test on a development store first and keep a backup of your theme.
Building for several client stores? See ShopMCP for Shopify developers. ShopMCP is free on partner development and client transfer stores.