The Shopify Storefront API exposes products, collections, search, cart, customer accounts, metaobjects, and localised content. It deliberately excludes admin operations — no order editing, no inventory writes — making the public token safe for client-side use. This guide covers the complete Shopify Storefront API integration: tokens, queries, cart flow, and the caching strategy that determines storefront performance. Refer to the Shopify Storefront API reference for the full schema.

Shopify Storefront API — access tokens, product queries, cart mutations and Customer Account API by CodeAtoZ

The Shopify Storefront API uses two token types. The public access token is safe for client-side code — it is rate-limited per visitor IP, not per app, so one customer cannot exhaust another’s quota. The private access token is for server-side calls with higher limits and should never reach the browser. Create both in the Headless sales channel (or a custom app’s Storefront API scope). Use the official @shopify/storefront-api-client package — it handles API versioning, token headers, and typed responses automatically.

import {createStorefrontApiClient} from '@shopify/storefront-api-client';

const client = createStorefrontApiClient({
  storeDomain: 'your-store.myshopify.com',
  apiVersion: '2025-01',
  publicAccessToken: process.env.NEXT_PUBLIC_SF_TOKEN,
});

const {data} = await client.request(`
  query Products($first: Int!) {
    products(first: $first, query: "available_for_sale:true") {
      nodes {
        id handle title
        priceRange { minVariantPrice { amount currencyCode } }
        featuredImage { url altText width height }
      }
    }
  }
`, { variables: {first: 12} });

The Shopify Storefront API cart flow is mutation-driven: cartCreate initialises the cart, cartLinesAdd, cartLinesUpdate, and cartLinesRemove manage items, and cartBuyerIdentityUpdate attaches the customer. The cart persists for 10 days — store the cart ID in a cookie and reuse it across sessions. When the customer is ready to pay, redirect them to the cart’s checkoutUrl field — Shopify’s hosted checkout handles payment, tax, and shipping. This is the recommended pattern; building fully custom payment against the Shopify Storefront API requires Shopify Plus and the Checkout Branding API instead. Check the Storefront API cart documentation for all mutation payloads.

Caching is where most Shopify Storefront API implementations win or lose. Product and collection queries are highly cacheable — cache them at the edge for 60 seconds to 1 hour depending on price-change frequency. Cart queries must never be cached. For customer login, the new Customer Account API (OAuth-based, passwordless) replaces the classic customerAccessTokenCreate mutation flow for new builds — it provides hosted login pages and stronger session security. Our Shopify development team builds headless storefronts on the Shopify Storefront API with Hydrogen and Next.js. See our Shopify Hydrogen storefront guide for the framework-level view, and the Customer Account API documentation for the login integration.