Authentication

Every SlotSmith Admin API request is authenticated the same way Shopify Admin API requests always are — no separate SlotSmith API key.

Access tokens

SlotSmith’s API surface is exposed as part of your app’s Shopify Admin API access. Requests are authenticated with the standard X-Shopify-Access-Token header, using the access token issued during your app’s OAuth flow.

bash

curl "https://{shop}.myshopify.com/admin/api/2026-07/zones.json" \
  -H "X-Shopify-Access-Token: {access_token}"

Required scopes

Reading and writing zones requires the read_shipping / write_shipping scopes at minimum. See each endpoint’s reference page for any additional scope it needs.

Rate limits

SlotSmith endpoints share Shopify’s standard Admin API rate limit — there is no separate SlotSmith-specific limit or bucket.