Skip to content

Shopify CLI Key

Service Name: Shopify

Service Description: Shopify is an e-commerce platform that allows individuals and businesses to create online stores to sell products and services. It provides a comprehensive suite of tools for managing inventory, processing payments, and handling shipping.

Service Address: https://shopify.com

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to Shopify CLI tools for managing Shopify stores, themes, and apps development.

Secret Revokement URL: https://admin.shopify.com/settings/apps

Secret Example: atkn_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Suspicious Activity Investigation Instructions:

  • Check Shopify admin panel for unauthorized app installations or theme changes
  • Review API call logs for unusual patterns or high volumes of requests
  • Monitor for unexpected changes to store settings, products, or themes
  • Check for unauthorized access from unfamiliar IP addresses
  • Review webhook configurations for any unauthorized endpoints

Mitigation Instructions:

  • Log in to your Shopify admin panel
  • Navigate to Settings > Apps and sales channels
  • Find the app associated with the compromised key
  • Click on the app and select "Remove app"
  • Generate a new API key if needed for legitimate applications
  • Enable two-factor authentication for your Shopify account
  • Review and update user permissions for staff accounts