Wrap your Shopify admin tokens in proxy tokens with IP restrictions and instant revocation — protect store and customer data.
See how ShieldKey protects your Shopify integration with minimal code changes.
const response = await fetch(
"https://my-store.myshopify.com/admin/api/2024-01/products.json",
{
headers: {
"X-Shopify-Access-Token": "shpat_abc123..." // ← store access
}
}
);
const products = await response.json();const response = await fetch(
"https://proxy.shieldkey.io/shopify/admin/api/2024-01/products.json",
{
headers: {
"Authorization": "Bearer sk_shield_t_6c8b..." // ← revocable
}
}
);
const products = await response.json();Disable any team member's access to your Shopify key in one click. No key rotation. No downtime. No re-deploying environment variables.
Set per-token spend caps so a compromised token can't run up your Shopify bill. Get alerts before limits are hit.
Restrict each shield token to specific IPs or CIDR ranges. Even if a token leaks, it's useless from unauthorized networks.
See every API call made through your Shopify key — who made it, when, from where, and what they accessed.
Your Shopify key is encrypted with AES-256-GCM. It's only decrypted in memory during request proxying — never stored in plaintext.
Issue individual shield tokens to each team member. When someone leaves, revoke their token — everyone else keeps working.
Add your Shopify key to ShieldKey's encrypted vault. ShieldKey generates a proxy token (starting with sk_shield_t_) that your team uses instead. Your real shpat_ key stays encrypted and is never exposed to team members.
Yes. Point your @shopify/shopify-api SDK at proxy.shieldkey.io and use a shield token instead of your real API key. The SDK works identically — ShieldKey transparently proxies every request.
Revoke their shield token from the dashboard. Your real Shopify key stays active — no rotation, no downtime, no re-deploying secrets across services. Everyone else keeps working without interruption.
ShieldKey's proxy adds less than 25ms at the p50. The proxy decrypts your key in memory, forwards the request, and streams the response back. For most Shopify API calls, this overhead is negligible.
Set up ShieldKey in under 5 minutes. No credit card required.
Start Free