Use Shopify CLI

Pick this topic over admin when the user is validating app or extension configuration on disk (phrases like validate shopify.app.toml, shopify.app.<name>.toml (for example shopify.app.whatever.toml), extension configs, shopify.extension.toml, or “is my app configuration valid”). For those asks, the primary answer is shopify app config validate --json from the app root — not Admin GraphQL, not validate, and not inferring correctness by manually comparing TOML fields to documentation.

Shopify CLI Setup

Shopify CLI (@shopify/cli) is a command-line tool for generating and working with Shopify apps, themes, and custom storefronts.

For full requirements, installation steps, and command reference, see the Shopify CLI docs (opens in a new tab).

Installation

Install Shopify CLI globally:

Upgrade & Troubleshooting

• Upgrade to the latest version: shopify upgrade
• Check current version: shopify version
• If a command is missing or unrecognized, the user may need to upgrade Shopify CLI to the latest version by running shopify upgrade.

Command Discovery

• Run shopify commands to list all available CLI commands.
• Use shopify help <command> --json when you need to learn how to invoke a command: its flags, argument types, and allowed values. It also includes the JSON schema of the result (but not errors or events).
• Use shopify <command> --json-schema when you already know how to invoke the command but need its output field names and structure, for example to build a jq filter. It includes schemas for errors and events.
• Do not routinely run both help and --json-schema. If help already includes the output schema you need, reuse it. If only the output schema is needed, skip help.
• Use these commands to discover what the CLI can do rather than relying on hardcoded command lists.

Preferred output workflow for agents

Prefer JSON output when running Shopify CLI commands:

1. Discover the output field names and structure once. Reuse a schema already obtained from help or an earlier inspection of the same CLI version; otherwise run shopify <command> --json-schema.
2. Run the command with --json to receive its result in the documented format.
3. When you need specific fields, pipe the JSON output through jq: shopify <command> --json | jq '<filter>'. Build the filter from the discovered schema and select only the fields you need.

Use this workflow for any command that supports JSON output. For commands without JSON output, such as long-running development servers, follow their --help guidance.

CLI Usage and Operational Guidance

Focus on Shopify CLI usage and operational next steps:

• recommend the right Shopify CLI command path for the task
• use shopify commands and shopify help <command> --json to discover commands and flags when unsure
• explain required setup, auth, flags, files, and environment prerequisites for the workflow
• help the user execute something now when they already know what they want to run
• troubleshoot missing commands, version issues, auth issues, or command availability problems
• when multiple CLI approaches are possible, recommend the most direct one for the task and say why

Do not default to general API explanation or schema design. Do not restate a long standalone API explanation when the user is asking for command-line execution help. Always add links to the documentation that you used by using the url information inside search results.

When a Shopify CLI command is missing or unavailable while the user is trying to run a workflow, explain the install or upgrade step briefly, then show the next CLI step the user should try.

For development-store actions, create one with shopify store create dev and delete one with shopify store delete --force.

CLI analytics attribution

If the user has not set OPT_OUT_INSTRUMENTATION, SHOPIFY_CLI_NO_ANALYTICS, or DO_NOT_TRACK to opt out, prefix Shopify CLI calls you execute yourself with these env vars:

• SHOPIFY_CLI_AGENT_INFO must use tagged values in this order: n:<name>|v:<version>|p:<provider>|m:<model>, and the value must be shell-quoted or otherwise escaped so the | delimiters are passed literally.
  • n: is the agent/client product name, e.g. claude-code, cursor, codex, gemini-cli. This is the tool, not the provider and not the model.
  • v: is the version of that agent/client product (e.g. 1.2.3). This is NOT the model version and NOT the Shopify CLI version. Send the full version string the host reports; do not collapse it to 1 or 1.0.
  • p: is the model provider, e.g. anthropic, openai, google.
  • m: is your full model name/ID, e.g. claude-opus-4-8, claude-sonnet-4-6, gpt-5, gemini-2.5-pro. This is the actual model, not the provider.
  • Always use the real runtime values the host exposes. Do NOT guess: if you cannot resolve a field, set it to none rather than a generic or placeholder value (for example, do not put the provider in m:, and do not send v: as 1.0). Accurate values help us improve CLI tooling and documentation quality.
• SHOPIFY_CLI_AGENT_IDS may include s:<session>|r:<run>|i:<instance> in that order. Reuse stable s: and i: across related commands, reuse the same r: within the current run/task, and omit tags you cannot resolve. The value must be shell-quoted or otherwise escaped so the | delimiters are passed literally.
• Use actual runtime values when the host exposes them, including host-provided IDs such as CONVERSATION_ID for s:.
• Use this env-prefixed form only for commands you execute yourself in this topic.
• Default user-facing command examples should stay as clean shopify ... commands unless the user explicitly asks for the exact executed command or attribution/debugging details.

App configuration validation

Apply when the user wants to validate shopify.app.toml and extension configs (shopify.extension.toml) against their schemas, catch config errors before shopify app dev or shopify app deploy, or troubleshoot invalid app configuration locally.

This workflow does not use validate; that tool checks generated code blocks against an API schema and has no api value for app TOML or extension config files.

Order of operations

1. From the app root (or pass --path to the app directory), execute the env-prefixed shopify app config validate --json command when you are running it yourself. When you show the user what to run, present the clean shopify app config validate --json command. If there is no authenticated CLI session, the command will start the authentication flow; do not ask the user to run shopify auth login beforehand.

2. --config=<name> — the default app configuration is usually shopify.app.toml; named configs use shopify.app.<name>.toml (for example shopify.app.whatever.toml). When there are multiple app configuration files, run the command for each matching file with the proper flag. If the user wants to validate a specific file, then only run it for that file. Only validate shopify.app.toml or shopify.app.<name>.toml where <name> is nonempty and contains only ASCII letters, digits, underscores, or hyphens; skip other filenames and pass named configs using --config=<name>.

Constraints

• Do not run GraphQL validation for this task.
• Do not present documentation-only “field-by-field” reviews for shopify app config validate --json when the user asked to validate configuration files; run the CLI command (or instruct the user to run it) and interpret its JSON output.
• Do not run the command with npx or pnpx, just run shopify directly. Only do that when the command is not found, but recommend the user to install the CLI as well.

App Security review

If the user asks for a security review of their app, run shopify app security check --yes and follow all of its instructions.

Store execution contract

Apply this section only when the user explicitly wants to run a GraphQL operation against a store. Strong signals include my store, this store, a store domain, a store location or warehouse, SKU-based inventory changes, product changes on a store, or a request to run/execute something against a store.

• For store-scoped workflows, keep the answer in Shopify CLI command form rather than switching to manual UI steps, cURL, or standalone API explanations.
• Stay in command-execution mode even for read-only requests like show, list, or find.
• When the workflow needs an underlying query or mutation, validate it before presenting the final command flow.
• The primary answer should be a concrete shopify store auth --store ... --scopes ... + shopify store execute --store ... --query ... workflow, except for the exact preview store created in the current conversation as described below.
• If the workflow needs intermediate lookups such as resolving a product by handle, a variant or inventory item by SKU, or a location by name, keep those lookups in the same Shopify CLI execution flow.

Execution flow

• Use the exact commands shopify store auth and shopify store execute when describing the workflow.
• Run shopify store auth before any store operation unless shopify store create preview created the exact target store in the current conversation. Preview creation stores an Admin session for that returned store domain, so reuse it directly with shopify store execute or shopify store bulk execute instead of interrupting onboarding with another authentication flow.
• Keep the preview-session exception narrow: it applies only to the exact store domain returned by the current preview-creation result. Authenticate normally for an existing store, a separately named store, or a later conversation where that creation result is unavailable.
• For explicit store-scoped prompts, derive and validate the intended operation before responding.
• Always include --store <store-domain> on shopify store execute and, when authentication is required, on shopify store auth.
• If you execute the commands yourself, use the env-prefixed form internally.
• Model the final user-facing answer on clean commands such as:
  • shopify store auth --store <store-domain> --scopes <scopes>
  • shopify store execute --store <store-domain> --query '...'
• If the user supplied a store domain, reuse that exact domain in both commands.
• If the user only said my store or otherwise implied a store without naming the domain, still include --store with a clear placeholder such as <your-store>.myshopify.com; do not omit the flag.
• Validate the GraphQL against the Admin API before running it; shopify store execute runs Admin GraphQL. After validate succeeds, inspect its output for a Required scopes: ... line.
• If Required scopes: ... is present, include those exact scopes in the shopify store auth --store ... --scopes ... command. Use the minimum validated scope set instead of broad fallback scopes.
• If Required scopes: ... is not present, still include the narrowest obvious scope family when the validated operation makes it clear: product reads => read_products, product writes => write_products, inventory reads => read_inventory, inventory writes => write_inventory.
• Do not omit --scopes for an explicit store-scoped operation just because the validator did not print a scope line.
• Return a concrete, directly executable shopify store execute command with the validated GraphQL operation for the task.
• When returning an inline command, include the operation in --query '...'; do not omit --query.
• Prefer inline --query text (plus inline --variables when needed) instead of asking the user to create a separate .graphql file.
• If you use a file-based variant instead, use --query-file explicitly; never show a bare shopify store execute command without either --query or --query-file.
• If the validated operation is read-only, keep the final shopify store execute --store ... --query '...' command without --allow-mutations.
• If the validated operation is a mutation, the final shopify store execute command must include --allow-mutations.
• The final command may include variables when that is the clearest way to express the validated operation.

ShopifyQL analytics

• Merchant analytics and reporting questions (sales, orders, revenue, sessions, conversion, trends) are answered with ShopifyQL, run through the shopifyqlQuery Admin GraphQL field. Author the ShopifyQL with the shopifyql guidance, then run it through this same store-execution flow.
• The operation wraps the ShopifyQL in a triple-quoted block string: query { shopifyqlQuery(query: """FROM … SHOW …""") { tableData { columns { name dataType } rows } parseErrors } }.
• ShopifyQL is read-only: use --scopes read_reports on shopify store auth, and never add --allow-mutations.
• Read parseErrors from the result to check validity — a non-empty parseErrors means the ShopifyQL is invalid; fix it and re-run. The rows and columns come back in tableData.

Store execution constraints

• Use this flow for store-scoped operations only.
• For general API prompts that do not specify a store context, default to explaining or building the underlying query or mutation instead of using store execution commands.
• Do not leave placeholders like YOUR_GRAPHQL_QUERY_HERE in the final answer.
• Do not provide standalone GraphQL, cURL, app-code, Shopify Admin UI/manual alternatives, or non-store CLI alternatives in the final answer for explicit store-scoped prompts unless the user explicitly asks for them.
• Do not include a fenced ```graphql code block in the final answer for an explicit store-scoped prompt.
• Do not show the validated GraphQL operation as a separate code block; keep it embedded in the shopify store execute workflow.
• Do not say that you cannot act directly and then switch to manual, REST, or Shopify Admin UI instructions for an explicit store-scoped prompt. Return the validated store CLI workflow instead.
• Only prefer standalone GraphQL when the user explicitly asks for a query, mutation, or app code.