Until recently, a merchant could create a "custom app" inside their own Shopify admin and paste a long-lived API token into a tool like ours. Shopify closed that creation flow in 2026 — existing tokens keep working, but new stores can't mint them anymore.
The current official path is Shopify's OAuth authorization flow: you click Connect, review the exact permissions on Shopify's own page, approve, and you're done. The permissions we request are strictly read-only:
read_orders — count orders and read order risk flags (denominator of your dispute rate)read_shopify_payments_disputes — read your payment disputes and their deadlinesThat's the whole list. We cannot modify orders, issue refunds, edit products, touch settings, or move money. You can revoke access in Shopify admin (Settings → Apps) at any time, one click.
Your token is used per-request and is not stored on our servers. See the Privacy Policy for exactly what we keep.
If your store still has an older admin-created custom app, the dashboard's Advanced: manual token option lets you use that existing shpat_… token (needs read_orders + read_shopify_payments_disputes). The token stays in your browser and is sent only to query Shopify on your behalf.