Where the OAuth credentials actually are
Log in to your Shopify Partners account, open Apps from the left menu, and select the app you created. On the app's Overview (some editions label it "API access" or "Client credentials"), you will see two fields:
- Client ID — a public identifier for your app. Safe to expose; it travels in the OAuth authorization URL.
- Client secret — the private half. Treat it like a password. It signs your token requests and verifies that incoming webhooks are genuinely from Shopify.
Shopify's developer docs are blunt about the naming confusion: the terms "API key" and client_id mean the same thing, and "API secret key" and client_secret are the same value (Shopify — About client credentials). If a guide or a third-party tool asks for one label and your dashboard shows the other, you are looking at the right field.
Copy the secret carefully
The client secret is usually shown once or behind a reveal button. Copy it into your app's environment configuration, not into a public repo, a screenshot, or a support-chat message. If it leaks, rotate it — Shopify lets you generate a new secret and revoke the old one from the same screen, which invalidates anything using the compromised value (Shopify — About client credentials).
Client ID and client secret: what each one does
Think of the pair as an app's login. The client ID says who is asking; the client secret proves the app is who it claims to be.
During OAuth, your app sends the merchant to Shopify with the client ID and a list of requested scopes (permissions). The merchant approves, Shopify returns a temporary code, and your app exchanges that code — signed with the client secret — for an access token. That token is what actually reads orders or products.
One detail the thin SERP guides skip: for an app installed on your own store via token exchange, Shopify returns an access token that is valid for a limited window and must be sent in the X-Shopify-Access-Token header on every API call (Shopify — About client credentials). The client secret is not the token — it is the key that mints tokens.
Custom app vs public app: which credentials you need
This is the fork most merchants get stuck at, and the top-ranking articles blur it.
- Public / published app. Built in the Partner Dashboard, distributed through the Shopify App Store or an install link, and installable on many stores. It uses OAuth 2.0. The client ID and secret stay inside the app's own server — you, the merchant installing it, never touch them.
- Custom / private app. Built for a single store, often to run your own automation or a bespoke integration. Here you (or your developer) hold the credentials directly and wire them into your code.
So if your goal is "connect my store to an analytics or profit tool," you almost never need to copy an OAuth secret. You are installing a public app, and the whole point of the OAuth flow is that Shopify handles the credential exchange so the merchant only sees a permissions screen. Pasting a client secret by hand is a builder's task, not a store owner's.
Why any of this matters: the connection is the point
Credentials are plumbing. The reason to connect an app at all is to get numbers out of Shopify and into something that answers a real question.
And here is the gap. Shopify's own reports are the trustworthy system of record for revenue and orders, but native analytics does not calculate net profit after ad spend, shipping, fees, and returns — and it credits sales on last-click attribution only. Independent guides list these as the standard blind spots of built-in reporting (Luca — Shopify Analytics Guide). Closing them is exactly why the connected-app ecosystem exists, a landscape we map in our guide to ecommerce business intelligence.
Different connected tools answer different questions. A profit tracker answers did I keep money, an attribution tool answers which ad worked, and a dashboard answers show me everything at once — the trade-offs are covered in our roundup of the best reporting tools for ecommerce. Choosing between them is easier once you know what each connection is for.
A worked example: what a connection is worth
Say you sell a print-on-demand hoodie for $50. Native Shopify shows you the $50 in revenue and, on higher plans with COGS entered, the gross margin. It does not show the rest of this table.
The layered contribution-margin method below follows the CM1/CM2/CM3 framing used across ecommerce finance guides (Saras — Ecommerce Contribution Margin):
| Line | Amount |
|---|---|
| Selling price | $50.00 |
| − COGS (blank hoodie + print + inbound freight) | −$15.00 |
| = CM1 (gross profit) | $35.00 (70%) |
| − Outbound shipping / fulfillment | −$8.00 |
| − Payment + platform fees (~3%) | −$1.50 |
| = CM2 | $25.50 (51%) |
| − Attributed ad spend (your share of CAC) | −$12.00 |
| − Returns reserve | −$3.00 |
| = CM3 (true contribution) | $10.50 (21%) |
The arithmetic runs $50.00 − $15.00 − $8.00 − $1.50 − $12.00 − $3.00 = $10.50. A product that looks like a 70% margin winner is really keeping about 21% once you sell it online. For DTC brands, that compression is typical — gross margins often run in the sixty-to-eighty-percent range while contribution margin lands closer to fifteen-to-thirty percent on the same item (Luca — Contribution Margin vs Gross Margin).
You cannot get the bottom line of that table from Shopify alone, because Shopify does not know what you spent on Meta or Google Ads or what Printify or Printful charged you. That cost data lives in other accounts, each behind its own connection.
Where PodVector fits
PodVector is one of the apps you install through that standard OAuth flow — click install, approve the scopes, and you are done; there is no client secret for you to paste. Once connected, it links Shopify with Meta Ads, Google Ads, Printify, and Printful, then computes true per-order profit — the CM3 line above — for every order automatically.
PodVector is not a dashboard you have to read. Its AI operator, Victor, analyzes your live data and proposes moves; when a change belongs on the Shopify side, he can act on it with your approval. Victor reads your ad data to explain what is working, but he does not touch your ad account — the writes he executes are Shopify-side. If you want to compare that model against a conventional analytics setup, see our breakdown of Shopify sales data analysis tools and alternatives.
For a purely native path — before you connect anything — you can also reshape what the built-in admin shows you; we walk through that in our guide to customizing your Shopify dashboard.
FAQs
Where exactly do I find the OAuth credentials in the Partner Dashboard?
Open Apps, select your app, and look at the Overview or API access screen. The Client ID and Client secret are shown there. Older interface versions label the same two fields "API key" and "API secret key" — do not go hunting for separate values.
Is the client secret the same as an access token?
No. The client secret is a long-lived key that your app uses to request access tokens during OAuth. The access token is the short-lived credential that actually authorizes API calls, and Shopify returns it in exchange for an authorization code signed with your secret (Shopify — About client credentials). Never treat them as interchangeable.
Do I need these credentials to connect a normal App Store app?
No. Published apps handle their own credentials server-side. As the installing merchant, you only see a permissions screen and click install — the OAuth handshake happens for you. You copy a client secret by hand only when you are building a custom or private app yourself.
What happens if my client secret leaks?
Rotate it immediately from the same credentials screen, then update your app to use the new value. Rotating generates a fresh secret and revokes the old one, so anything relying on the leaked value stops working (Shopify — About client credentials). Because the secret also verifies webhook authenticity, a leak is worth taking seriously.
Why connect an app instead of just using Shopify's reports?
Because native reports are the system of record for revenue but do not compute net profit after ad spend, shipping, fees, and returns, and they attribute sales on last-click only (Luca — Shopify Analytics Guide). Connecting the accounts that hold your cost and marketing data is what turns "revenue" into "what you actually kept." A good next step is our overview of reporting tools for ecommerce.
Are the scopes I approve during OAuth the same as the credentials?
No. Scopes are the permissions an app requests (read orders, read products, and so on); the client ID and secret are the app's identity. During the OAuth flow the app presents its client ID and the scopes together, and you approve the scopes before any access token is issued.