The Storefront API is Shopify's GraphQL API for buyer-facing experiences outside or alongside the theme: headless sites, mobile apps, games and custom widgets. It reads products, collections and search results, builds carts and hands buyers to checkout, with basic data open without a token and the rest behind one.
The Storefront API is Shopify’s GraphQL API for buyer-facing experiences outside or alongside the theme: headless sites, mobile apps, games and custom widgets. It reads products, collections and search results, builds carts and hands buyers to checkout, with basic data open without a token and the rest behind one.
What works without an access token?
Tokenless access covers products and collections, selling plans, search, pages, blogs and articles, and cart reads and writes. Product tags, metafields, metaobjects, menus and customer data need a public or private access token.
The Storefront API reference caps tokenless queries at a complexity of 1,000, worked out from the cost of each field: “When using tokenless access, query complexity that exceeds 1,000 will result in an error.” A public token, sent in a header, is made for browsers and apps where buyers can see it. A private token stays on a server, such as a Hydrogen backend, and should pass the buyer’s IP address so Shopify can tell shoppers apart. An app can hold up to 100 active storefront tokens per shop. To build before a store exists, Shopify’s headless docs point to mock.shop, a public Storefront API with demo data that needs no store and no token.
What is the difference between the Storefront API and the Admin API?
Audience. The Storefront API serves buyers, for browsing, carts and checkout. The GraphQL Admin API reads and writes the merchant’s data, such as orders and inventory, and needs an app token granted by the merchant.
The authentication guide lists the split by header and token type, next to the Customer Account API, which lets a signed-in buyer read their own orders and addresses. Their rate rules differ too. Storefront traffic from real buyers has no fixed requests-per-minute limit, bots are limited, and checkout creation is throttled with a 200 Throttled error. A request that looks malicious gets a 430 Shopify Security Rejection.
How did 29 real stores answer?
On 18 October 2026 we sent tokenless queries to 29 live Shopify stores. 21 answered, in 1.7 to 11.3 seconds (median 4.1), and all 21 refused a metafield read, asking for the unauthenticated_read_metafields scope.
One store rejected the request with HTTP 411 and 7 didn’t answer within 40 seconds. A query for 250 products with 250 variants each was priced at a requested cost of 144, well under the 1,000 limit, so big catalogue reads are realistic without a token. The basic shop and product query cost 11. Speed varied more than access: the slowest answer took over 6 times as long as the fastest, so cache catalogue reads rather than calling the API on every page view.
Example (a hypothetical candle store building a mobile app): products, search and the cart all work tokenless. Showing each candle’s burn time, stored in a metafield, needs a public token with the metafield read scope, and the app must handle the 200 Throttled response if many buyers check out at once. For a full headless commerce build, our Next.js development team and Shopify development service work on the API, the front end and checkout together.