Reachable Shopify Storefront API for Agent-Driven Browsing and Checkout
Exposes the Shopify GraphQL API that AI agents use to list products, build carts, and produce checkout URLs.
What this signal tests
We check, for Shopify-hosted stores, whether the dated Storefront GraphQL API endpoint is reachable. Shopify exposes this endpoint at a predictable URL on every store, but it must be enabled and accessible. We also reward stores that publish a discoverable public access token, because that token is what allows an agent to authenticate.
Why it matters for your visibility in AI
Shopify powers a large share of independent commerce on the web, and its Storefront API is the most widely deployed agent-callable commerce surface in existence. Every Shopify store has one - built in, no extra build required - and any AI agent with a Storefront access token can list products, build carts, and produce real checkout URLs ready to hand back to the user. The consequence of leaving it disabled or undiscoverable is straightforward: agents skip you. They cannot tell what you sell, cannot quote prices accurately, and cannot help a customer assemble a cart. Enabling the Storefront API is a one-time configuration in the Shopify admin; publishing the access token in an agent-discoverable location takes another few minutes. Together they convert a Shopify store from invisible to fully agent-shoppable.
Pass criteria at a glance
| Criterion | Passes when |
|---|---|
| Storefront API endpoint resolves; stronger pass if public access token discoverable. |
How we test it
Our scanner first confirms the site is Shopify-hosted by looking for X-Shopify-* response headers and cdn.shopify.com asset references. If it is, it then probes the dated Storefront API endpoint at the conventional URL pattern with an OPTIONS request. The signal passes when the endpoint resolves; a stronger pass is recorded if a public Storefront access token can be discovered on the site.
Show technical detection method
If Shopify (X-Shopify-* headers, cdn.shopify.com assets), probe https://{shop}.myshopify.com/api/{version}/graphql.json with OPTIONS.
If your site fails: how to fix it
- In your Shopify admin, install or enable a Storefront-enabled app and confirm the Storefront API is active for your store; this is a built-in capability and does not require custom development.
- Generate a read-only Storefront access token scoped to the public catalog data you are happy for AI agents to access (products, collections, prices, availability).
- Publish the access token in a discoverable location - a /.well-known/shopify-storefront JSON document, a meta tag on your storefront, or an /agent page - so agents can authenticate without a bespoke handshake.
- Test the endpoint with a real GraphQL client to confirm products and prices return as expected, and that introspection works so agents can self-discover the schema.
- Document the access token's rate limits and any IP allowlist in your /agent or /.well-known/shopify-storefront page so agents can pace themselves correctly.
Quick facts
| Maturity | ESTABLISHED |
|---|---|
| Weight | medium |
| Category | Agent Actions |
Primary sources
Related signals
Frequently asked questions
Is publishing a Storefront token safe?
Yes, when the token is read-only and scoped to public data. Storefront tokens are designed to be embeddable in client-side code, including JavaScript that ships to every visitor's browser. Treat them like a public API key - useful for discovery, not a credential to protect.
We are not on Shopify - does this signal apply?
No. This signal is specifically about Shopify-hosted stores because the Storefront API is built into the platform. If you use a different commerce platform, focus instead on publishing OpenAPI, BuyAction markup, and Stripe buy buttons. Some platforms have their own agent APIs worth exposing similarly.
Does this cost anything to implement?
Enabling the Storefront API is included in every Shopify plan at no additional fee. Generating and publishing a token costs nothing beyond the configuration time. The Storefront API does have its own rate limits, but typical agent traffic is well below them.
How do I know if my customers' AI agents will visit my site?
AI shopping assistants in ChatGPT, Perplexity, and emerging commerce-specific agents already consume Shopify Storefront APIs at scale via published wrappers and SDKs. If your customers shop with AI help, your store is either reachable or invisible - the Storefront API is what makes it the former.
Run your own scan
Run a free scan and see how your site grades across all 155 AI-readiness signals.