Shopify integration

Your storefront, live in the workspace

Connect a Shopify store and bind it to the project holding that store's theme. When you start a session, Spaceboy runs Shopify's own development server — so the preview beside your agent is your actual storefront, with your real products and content, updating as the agent edits your theme. Describe the change, watch it happen on your store, approve the pull request.

From zero to storefront preview

Four steps, in order:

• Get a theme project — start from a Shopify template in New project, or bring your own theme repository with New project → Migrate an existing repo. The migration agent recognizes a Shopify theme and sets the project up on the Shopify platform.
• Connect your store on the Integrations page — app credentials plus a Theme Access password, walked through below — then use Connection defaults on the Shopify card to bind the project to the store.
• Add the repobot.sandbox.json preview recipe below to the repo — or just ask your agent to set it up in your first session.
• Open the project's workspace. The preview beside your agent is your live storefront, hot-reloading as the agent edits the theme.

Connecting Shopify

Choose Connect on the Shopify card of the Integrations page. The form collects two credentials in one flow: a Dev Dashboard app's Client ID and Client Secret, which cover theme work and store operations (products, sales questions), and a Theme Access password, which the live storefront preview needs on password-protected stores. The form starts with your store's .myshopify.com address — that's your store's name as it appears in your Shopify admin's web address (admin.shopify.com/store/my-brand means my-brand.myshopify.com), and pasting the whole admin URL works too. It is not an email address — an easy slip, since email is how the Theme Access password arrives.

Spaceboy stores every credential in the encrypted secret store — it is never shown again and never reaches the agent's shell. Not sure which option fits? Ask the agent in chat: it knows these steps and walks you through them, and the conversation picks back up on its own the moment your store connects.

The Dev Dashboard app credentials

The backbone of the connection, and the only credential shape Shopify still lets merchants newly create. You create an app in Shopify's Dev Dashboard and hand Spaceboy its Client ID and Client Secret; Spaceboy exchanges them server-side for short-lived tokens as needed, so your sessions only ever see expiring tokens — never the secret itself.

• Open dev.shopify.com/dashboard with the account that owns your store, choose Create app, then Start from Dev Dashboard — any name works.
• Select the newly created app, select Versions from the sidebar, then Create version. Under URLs, paste https://shopify.dev/apps/default-app-home as the App URL — Shopify's stock address for apps with no UI; the field is required but never visited. Under API access, paste the scope list into the scope field — it accepts the whole comma-separated list in one paste: read_themes,write_themes,read_products,write_products,read_files,write_files,read_publications,write_publications,read_orders,read_reports,read_customers (read_customers, last in the list, lets agents mention customer names and emails in chat when you ask about customers — delete it off the end before pasting if you'd rather they never see identity; everything else works without it). Then select Release.
• From the same Dev Dashboard, select your app. On the Overview page, go to Installs and click Install App. This is the step people miss — credentials only work after the install, and skipping it is what a shop_not_permitted error at connect time means.
• Copy the Client ID and Client Secret from the app's Settings page and enter them in the connect form.

Spaceboy verifies the credentials with a live exchange against Shopify when you connect, so a missed step surfaces right in the form — not later as a broken preview. It also records which scopes the app was granted; the connection's card shows whether store operations are available. Scopes are upgradable in place: edit the app's scopes in the Dev Dashboard, approve them on the store, then hit Verify on the connection — no re-connect needed.

The Theme Access password

The companion credential in the same connect form: a password minted by Shopify's own Theme Access app, which Shopify's tooling requires to open a live preview of a password-protected storefront — and development stores are always password-protected. It's technically optional, but without it the workspace shows a static preview instead of your live storefront, so treat it as part of connecting.

• Install the free Theme Access app from the Shopify App Store on your store.
• Open Theme Access from your store's Apps menu and choose Create password, using your own name and email. Shopify emails you a link — open it to reveal the password, which starts with shptka_.
• Paste that password into the connect form's Theme Access password field, alongside the app credentials.

Theme Access opens as a blank page when you aren't signed in to that store's admin as a staff member — sign in at admin.shopify.com and reopen the app.

Have a custom app token from before 2026? Tokens starting with shpat_ still work — paste one in place of the Theme Access password. Shopify retired creating new ones on January 1, 2026.

The storefront password

If your storefront is password-protected — and Shopify development stores always are — add the storefront password when you connect, or the live theme preview can't start. Find it in your Shopify admin under Online Store → Preferences → Password protection. It's the password a visitor would type to see your unfinished storefront, not your Shopify login.

The theme preview recipe

Theme projects carry a repobot.sandbox.json that starts Shopify's theme dev server (templates and migrated themes get one automatically; you can also ask your agent to add it). The connected store's domain, credentials, and storefront password are injected automatically, so the manifest stays free of secrets:

{
  "up": "shopify theme dev --port ${PORT}",
  "defaultPort": 9292,
  "readyUrl": "http://127.0.0.1:${PORT}/",
  "healthcheck": { "url": "http://127.0.0.1:${PORT}/", "timeoutMs": 120000 }
}

One store per project

Own more than one brand? Migrate each theme repository as its own project and bind each to its store. Every brand gets its own agent, its own preview, and its own clean PR trail.

• Changes ship as pull requests to your theme repository — publishing the theme stays in your hands.
• Use Connection defaults on the Shopify card to bind each project to its store.
• Revoke access anytime — delete the Theme Access password, uninstall the Dev Dashboard app in Shopify, or disconnect the store on the Integrations page.