---
name: iblai-connect-shopify
description: "Read and write Shopify data through the Shopify GraphQL Admin API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Shopify data, or to set up a Shopify MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Shopify connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/shopify — not part of the iblai/vibe repository. Checked against Shopify's documentation on October 20, 2026; test it against your own Shopify setup before you rely on it.

Hosted e-commerce platform. Each Shopify store holds products and variants, inventory by location, orders, refunds, fulfillments, customers, discounts and collections.

## Auth & conventions

- **API:** Shopify GraphQL Admin API (GraphQL). GraphQL endpoint for store administration: queries for products, orders, customers and inventory, and mutations such as productCreate, inventorySetQuantities and refundCreate. Versioned by quarter (e.g. 2026-10).
- **Base URL:** https://{store_name}.myshopify.com/admin/api/{api_version}/graphql.json
- **Access:** Public, self-serve. Developers create an app (Shopify CLI or Dev Dashboard) and install it on a store. Admin-created custom apps with pre-generated tokens are a legacy method that is no longer available for new apps.
- **Auth:** OAuth 2.0 authorization code; OAuth 2.0 token exchange (embedded apps); OAuth 2.0 client credentials (developer's own stores). Each request sends the X-Shopify-Access-Token header. Tokens are scoped (read_products, write_orders, write_inventory and so on); a write scope also grants read. Offline tokens persist across sessions; online tokens last a staff session.
- **Limits:** Calculated query cost in points per app and store: restores 100 points/second on Standard, 200 on Advanced, 1,000 on Plus, 2,000 on Shopify for enterprise. A single query may not exceed 1,000 points. Versions ship quarterly; each is supported 12+ months.
- Keep Shopify credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Orders** — orders query with filters and cursor pagination (first/after, up to 250 per page); needs read_orders.
- **Products and variants** — products query: titles, variants, prices, media and status.
- **Inventory levels** — Inventory items and quantities per location.
- **Customers** — customers query: contact details, order history and marketing consent fields.

## Writes

- **Create product** — productCreate mutation (write_products) creates a product with options and an initial variant.
- **Set inventory quantities** — inventorySetQuantities mutation (write_inventory) sets absolute quantities with compare-and-set; needs an idempotency key from 2026-04.
- **Refund an order** — refundCreate mutation returns money to the customer for line items or shipping; needs an idempotency key from 2026-04. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Shopify publishes an official MCP server, Shopify Dev MCP and Storefront MCP (https://shopify.dev/docs/apps/build/devmcp). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - Shopify supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List Shopify orders from the last 7 days that are paid but not yet fulfilled"
- "Which products have fewer than 5 units in stock at the main warehouse?"
- "Create a draft product called Linen Apron at $34 with sizes S, M and L"
- "Set the inventory for SKU MUG-BLUE to 40 units at the Brooklyn location"

## Guardrails

- Holds consumer personal data (names, addresses, order history) and marketing consent status. Card numbers stay in Shopify's checkout and do not pass through the Admin API; refunds move real money.
- Request the narrowest Shopify scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- GraphQL Admin API reference: https://shopify.dev/docs/api/admin-graphql
- GraphQL Admin API rate limits: https://shopify.dev/docs/apps/build/apis/graphql-admin/rate-limits
- Shopify Dev MCP server: https://shopify.dev/docs/apps/build/devmcp
- Shopify Dev MCP and Storefront MCP: https://shopify.dev/docs/apps/build/devmcp
- This connector on ibl.ai: https://ibl.ai/developer/connectors/shopify
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections