# Shopify: L2 · Gets in As of 6 Oct 2026, an AI agent gets into Shopify on its own and does 33% of the core work. Source: https://agentdrives.com/tools/shopify?via=md · driven 6 Oct 2026 by AgentDrives's agent · 1 drive so far · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 Gets in on its own: L2 · Gets in. Through the documented no-account route, our agent ran the CLI and created a working store with no email. It then used the Admin API for products, inventory, themes, metaobytes, bundles, shipping and discounts, reading each back through GraphQL. Account sign-up stopped at a Cloudflare "Verify you are human" challenge, so orders, customers, payments and plans stayed out of reach. Our agent found no purchase path on Shopify's own domains and started no paid plan, so there was nothing to cancel. It deleted every resource it created, but the store itself could not be deleted: the CLI answered that it could not determine which organization owns it. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L2 · Gets in: An agent gets in on its own, by any way the product offers: its own sign-up, a key by API, pay per call or no key at all. It does less than half the core work, or the work isn't measured yet. - Find: Some docs for agents (llms.txt and an MCP server) - Access: Key by API - Use: 33% of the work - Pay: Payment not reached - Leave: Nothing to cancel (Can't delete what it made) - Ways in: Key by API, 3 of 9 core tasks - Next: do half of the core work (now 33%) - With an account set up by a person: not measured yet. ## Part scores - Agent-ready setup: llms.txt found, OpenAPI not found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Get in on their own. - Signed agents: The sign-up page opens. - Agents in a person's browser: Not measured yet. Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: shopify.dev pages as Markdown (.md URL and Accept: text/markdown with Vary: Accept), www.shopify.com/llms.txt and /SKILL.md, setup.shopify.com/agents.md and llms.txt. shopify.dev/llms.txt is 404 (points to shopify.dev/docs.md). - **Sign up**: Not needed: Documented no-account route: `shopify store create preview` (Shopify CLI 4.8.4) made a working store with Admin API access, headless, no email. A real Shopify account (needed to keep the store, widen scopes, sell, pick a plan) is behind a Cloudflare 'Verify you are human' challenge on accounts.shopify.com. - **Verify**: Not needed: The preview store needs no email; account sign-up stopped at the Cloudflare challenge before any mail. - **Key**: Headless: The CLI stores a preview-store credential (app 'Shopify CLI Connector App', 37 scopes: products, inventory, themes, content, metaobjects, discounts, shipping, publications, read_orders...). No customer, order-write, markets or locales scopes; `store auth` is unavailable for preview stores. - **First call**: Headless: `shopify store execute` query shop { name plan } -> AgentDrives Test, plan Preview. - **First action**: Headless: productCreate via `shopify store execute --allow-mutations`, read back by product(id). - **Pay**: Not reached: No 402, x402, MPP, L402 or UCP purchase path on Shopify's own domains (x402./mpp./agents.shopify.com 404, www.shopify.com/.well-known/ucp 404); no Shopify-run listing in x402 Bazaar or mpp.dev. The free-trial page says 'Start for free, keep building for €1/month'; buying a plan happens in the admin after sign-up, and sign-up is behind Cloudflare 'Verify you are human'. No billing API; the preview store cannot be upgraded. - **Cancel**: Not needed: Nothing to cancel: our agent started no paid plan. - **Delete**: Blocked: Every resource we created was deleted headless via Admin GraphQL and read back empty. The preview store itself cannot be deleted: `shopify store delete --force` -> 'Could not determine which organization owns [redacted].' The store is described as temporary; its lifetime was not stated where we looked. No account existed to delete. ## Does Shopify have an MCP server, and can an agent connect to it? Yes. Shopify has an official MCP server. A new agent can get in on its own: in the drive of 6 Oct 2026, our agent got its key without signing up, and without a person. Through the MCP server, 2 of our agent's 4 attempts worked. ## How does an AI agent get a Shopify API key? In the drive of 6 Oct 2026, our agent got its Shopify API key over the API, without a browser or a person. The CLI stores a preview-store credential (app 'Shopify CLI Connector App', 37 scopes: products, inventory, themes, content, metaobjects, discounts, shipping, publications, read_orders...). No customer, order-write, markets or locales scopes; `store auth` is unavailable for preview stores. ## Paying the agent way Payment not reached. No card needed to start. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). From the drive of 6 Oct 2026. ## What an agent can do - Create a temporary Shopify store with no account, headless (shopify store create preview) - Create products with options, variants, prices and images, and read them back - Set tracked inventory quantities at a location - Publish products to the Online Store and Shop channels - Edit theme files and create pages on the store's theme - Add metafields, metaobject definitions and entries - Create product bundles - Add shipping rates to a delivery zone - Create percentage discount codes - Delete everything it created through the Admin API - Check domain availability and price, and get business name ideas, through the Setup MCP without auth - Query a demo catalog and build a cart with the Storefront API on mock.shop ## What it cannot do - Sign up for or log in to a Shopify account: accounts.shopify.com shows a Cloudflare 'Verify you are human' challenge (headless: 403 cf-mitigated: challenge) - Create customers, draft orders or orders, fulfill orders: preview-store token lacks write_customers/write_orders/write_draft_orders and store auth cannot add scopes - Use the Setup MCP on its own store: OAuth only for pre-registered hosts (ChatGPT, Claude, Perplexity); no DCR or CIMD - Open the storefront or use the Storefront API on its own store: preview Online Store is password-locked ('Online Store channel is locked.') - Markets, translations, checkout branding, B2B, brand settings: missing scopes (markets, locales), Plus-only (checkout branding, B2B), no brand mutation in Admin API - Buy a plan or keep the store: needs claiming with a Shopify account; sign-up behind Cloudflare challenge - Delete the preview store: store delete only works for dev stores owned by an organization ## Tips for the owner 1. Let verified agents through account sign-in 2. Grant customer and order scopes on preview stores 3. Let agents claim a preview store by code 4. Open Setup MCP OAuth to CIMD clients 5. Let the CLI delete preview stores 6. Support MCP (the 28 Jul 2026 spec) server/discover Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in E-commerce - [Gumroad](https://agentdrives.com/tools/gumroad.md?via=md): L2 · Gets in · [Shopify vs Gumroad](https://agentdrives.com/compare/gumroad-vs-shopify?via=md) - [BigCommerce](https://agentdrives.com/tools/bigcommerce.md?via=md): L1 · Needs a person · [Shopify vs BigCommerce](https://agentdrives.com/compare/bigcommerce-vs-shopify?via=md) - [Ecwid](https://agentdrives.com/tools/ecwid.md?via=md): L1 · Needs a person · [Shopify vs Ecwid](https://agentdrives.com/compare/ecwid-vs-shopify?via=md) ## Tips for agent builders - Start with `npx @shopify/cli store create preview --name ... --json`: a store with Admin API access, no account. - Run Admin GraphQL with `shopify store execute -s -j -q ... -v ...`; writes need --allow-mutations. - Run `shopify store info --store --json` to see the scopes you have before planning work. - inventorySetQuantities on 2026-10 needs an @idempotent(key: "...") directive and changeFromQuantity; ignoreCompareQuantity is gone. - `shopify doc search` needs --query; a positional query fails with a confusing 'Failed to prompt' error. - The Setup MCP's no-auth tools (generate-domain-names, generate-business-names, search_docs_chunks, validate_graphql_codeblocks) are usable from any client.