Leaked Shopify Access Token: what to do in the first hour

• Custom app scripts. Import scripts, inventory syncs and order exports written for one store, with the token pasted in to make them run.
• Theme and app repositories. A .env file, shopify.app.toml neighbour or deployment file committed with the token.
• Agency and freelancer handovers. A token sent over chat or email, then stored in a shared repository or a ticket.
• Integration glue. Zapier-style scripts, ERP and shipping connectors, and cron jobs that call the Admin API.
• Logs and screenshots. A failed API call printed with its headers, or a screenshot of the app’s credentials page shared for support.

1. Cut off the app. In the Shopify admin go to Settings → Apps and sales channels. For a custom app, open Develop apps, select the app and uninstall or delete it so its token stops working. Check the Shopify documentation for the exact behavior of your app type. For a public app, remove it from the store’s installed apps and contact its developer.
2. Issue a fresh credential. Create or reinstall the app with the minimum scopes it needs: if a script only reads products, do not grant order or customer access. Store the new token in a secret manager.
3. Work out what the old token could reach. Open the app’s configuration and read its Admin API access scopes. Orders and customer scopes mean personal data was readable; write scopes mean content could be changed.
4. Look for changes in the store. Review recent edits to products, prices, discount codes, shipping rates, payment settings, checkout customizations and theme code. Check the list of webhooks and other installed apps for entries you do not recognize, and the staff accounts for unfamiliar users.
5. Check for exfiltration signs. Bulk customer or order exports around the time of the exposure, or unexplained traffic to your webhook endpoints, are things to note.

Not sure what else leaked? Run a free scan.

6. Decide whether customer data needs a notification. If the token could read customer or order data and you cannot rule out access, you may have obligations under privacy law such as GDPR. Speak to a qualified adviser rather than guessing.
7. Then clean the repository: remove the value and rewrite history if you want to. See I accidentally pushed an API key to GitHub.

There is no single console for every token, because it depends on how the token was created. For a custom app, sign in to the store admin, open Settings → Apps and sales channels → Develop apps, choose the app and review its API credentials; removing or uninstalling the app ends its access. For an app from the Shopify App Store or your own Partner account, uninstall it from Apps and sales channels and manage the app’s credentials with its developer or in your Partner dashboard. If you manage several stores, check each one: a token only works on the store it was issued for.

The rule is called Shopify Access Token. It recognizes the shpat_ prefix followed by 32 hexadecimal characters, a shape specific enough to need no surrounding keyword. LeakWatch detects this format but does not check it live: it can tell you the token is exposed, not whether it still works. Assume it does until you have revoked it.