Shopigent vs a raw Admin API key
Technically, you don't need Shopigent to connect an LLM to Shopify. You can create a custom app, grab an Admin API token, and hand it to your agent. Merchants ask us why they shouldn't. Fair question — here's the honest comparison.
What a raw token gives you
- Everything, forever. Whatever scopes the token has, the agent has — 24/7, no questions asked.
- No record. Shopify logs API calls internally, but you have no readable trail of what your agent did or why.
- No brakes. A hallucinated ID in a
productDeletemutation executes just as happily as a correct one. - Raw GraphQL complexity. The agent burns tokens (and makes mistakes) constructing mutations, cursors, and error handling from scratch.
What curated tools change
| Raw Admin token | Shopigent | |
|---|---|---|
| Access control | All-or-nothing scopes | Per-tool and per-area switches. One connection key per store |
| Destructive actions | Execute immediately | Pause when that tool's confirmation is on. Four actions always pause |
| Visibility | None | Audit log (input, result, latency), with a redacted detail view |
| Agent ergonomics | Raw GraphQL | 87 curated merchant tools |
| Failure mode | The mutation runs | Invalid input is rejected. A gated write pauses. A write with confirmation off can still run |
| Revocation | Rotate the token and redeploy | Regenerate connection key, or uninstall |
The deeper point
Agents don't fail like humans. They fail confidently, at machine speed, in bulk. The right response isn't "never connect an agent" — it's structure the access so mistakes are cheap. Validated inputs catch many errors. A confirmation setting catches the writes you leave gated. It does not pause every write. The audit log records the call either way.
That's the entire product, honestly. Fewer capabilities exposed, with receipts.
On Free, reads run and a curated write preview is not executed. Custom tools are not included.