Admin API

Authentication

The Admin API authenticates every request with a custom app's access token, sent in the X-Sellify-Access-Token header. The token identifies both the app and the store, so you never pass a store ID.

How it works

Endpoint	`POST https://admin-sellifyhq.vercel.app/api/admin/2026-10/graphql`
Header	`X-Sellify-Access-Token: sfat_…`
Token format	`sfat_` + 32 random characters. Shown once; stored only as a SHA-256 hash.
Permissions	Limited to the app's access scopes.
Transport	HTTPS only in production. Requests and responses are JSON.

Get an access token

1
In the Sellify admin open Apps → Develop apps and click Create app.
2
Select the access scopes the app needs (for example read_products) and click Save scopes.
3
Click Install app and copy the token. It is displayed only once — store it in your secret manager or environment.

Terminal

export SELLIFY_TOKEN="sfat_your_token_here"
export SELLIFY_API="https://admin-sellifyhq.vercel.app/api/admin/2026-10/graphql"

Make a request

Send a GraphQL query in a JSON body with the token header:

curl -X POST "$SELLIFY_API" \
  -H "Content-Type: application/json" \
  -H "X-Sellify-Access-Token: $SELLIFY_TOKEN" \
  -d '{"query": "{ shop { name myshopifyDomain currencyCode } }"}'

Successful response

A valid token returns 200 OK with your data and the query's cost:

200 OK

{
  "data": {
    "shop": {
      "name": "Sellify Demo Store",
      "myshopifyDomain": "demo.sellify.in",
      "currencyCode": "INR"
    }
  },
  "extensions": {
    "cost": {
      "requestedQueryCost": 1,
      "actualQueryCost": 1,
      "throttleStatus": { "maximumAvailable": 1000, "currentlyAvailable": 999, "restoreRate": 50 }
    }
  }
}

Verify a token

The cheapest way to check a token (for example in a health check or after the merchant pastes one into your app) is a shop query — it costs 1 point and needs no scope:

cURL

curl -s -o /dev/null -w "%{http_code}\n" -X POST "$SELLIFY_API" \
  -H "Content-Type: application/json" \
  -H "X-Sellify-Access-Token: $SELLIFY_TOKEN" \
  -d '{"query": "{ shop { name } }"}'
# 200 → token is valid · 401 → wrong, rotated or revoked

Authentication errors

Missing, wrong, rotated or revoked token → 401 Unauthorized:

cURL

curl -i -X POST "$SELLIFY_API" \
  -H "Content-Type: application/json" \
  -H "X-Sellify-Access-Token: sfat_wrong" \
  -d '{"query": "{ shop { name } }"}'

Response

HTTP/1.1 401 Unauthorized
content-type: application/json
cache-control: no-store

{
  "errors": [{
    "message": "Invalid or missing access token. Send it in the X-Sellify-Access-Token header.",
    "extensions": { "code": "UNAUTHORIZED" }
  }]
}

Valid token, missing scope → 200 OK with an ACCESS_DENIED error naming the scope you need. Other fields in the same query still resolve:

200 OK — query: { orders(first: 1) { nodes { name } } } with only read_products

{
  "data": null,
  "errors": [{
    "message": "Access denied: this app needs the read_orders scope.",
    "path": ["orders"],
    "extensions": { "code": "ACCESS_DENIED", "requiredAccess": "read_orders" }
  }]
}

Status	Code	What to do
401	`UNAUTHORIZED`	Check the header name and token. If it was rotated or the app uninstalled, ask the merchant for the new token.
200	`ACCESS_DENIED`	Add the scope in requiredAccess under Apps → Develop apps → your app. Takes effect immediately — no new token needed.
404	`UNSUPPORTED_VERSION`	Use a supported API version in the URL.

Rotate & revoke

Action	Where	Effect
Rotate token	Apps → Develop apps → your app → Rotate token	Issues a new token; the old one fails with 401 immediately.
Uninstall	Apps → Develop apps → your app → Uninstall (revoke token)	All calls fail with 401. Scopes and webhooks are kept for reinstalling.
Delete app	Apps → Develop apps → your app → Delete app	Token, scopes and webhook subscriptions are removed permanently.
Change scopes	Apps → Develop apps → your app → Save scopes	Applies to the current token instantly.

Security checklist

✓Call the Admin API from your server only — never from a browser, storefront theme code or a mobile app.
✓Keep tokens in environment variables or a secret manager; never commit them to Git.
✓Request the fewest scopes possible (write scopes include read).
✓Rotate the token immediately if it may have leaked (logs, screenshots, chat).
✓Use HTTPS and verify TLS certificates — don't disable certificate checks.

Tip: try it in the browser

Paste your token into the API explorer to run queries without writing code.