Skip to content

Shopify Partners Key

Service Name: Shopify Partners

Service Description: Shopify Partners is a program that allows developers, designers, and marketers to create apps, themes, and services for Shopify merchants. It provides tools and resources for building Shopify-related businesses.

Service Address: https://www.shopify.com/partners

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to the Shopify Partners API, allowing management of partner account resources, apps, themes, and client stores.

Secret Revokement URL: https://partners.shopify.com/current/settings

Secret Example: prtapi_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Suspicious Activity Investigation Instructions:

  • Check Shopify Partners dashboard for unauthorized app installations or theme publications
  • Review API call logs for unusual activities or access patterns
  • Verify if there are any new collaborators added to your partner account
  • Check for unexpected changes to app settings or theme files
  • Monitor for unauthorized access to client stores

Mitigation Instructions:

  • Log in to your Shopify Partners account at partners.shopify.com
  • Navigate to Settings > API credentials
  • Locate the compromised API key and click "Revoke"
  • Generate a new API key if needed
  • Update all applications and services using the old key
  • Review and update security settings, including enabling two-factor authentication
  • Audit all connected apps and services to ensure they're legitimate