October 12, 2026: New guidance on choosing between a merchant PAT and an app, and PAT hygiene
View as MarkdownThe authentication docs now explain when to use a Personal Access Token (PAT) versus a Platform Application for your own store, and add PAT hygiene recommendations.
What changed
A new credential chooser on the About authentication page covers the common case directly: for your own store or account, with API calls kept on your server, use a PAT. For software other merchants install, where each merchant authorizes it to act on their account, use a Platform Application.
The Where a PAT fits guidance adds explicit hygiene recommendations. Grant the minimum scopes your integration needs, and set an expiry. Revoke a token you no longer use or that might have become compromised. If someone else builds the integration for you, create the PAT on your own account and share it securely, rather than letting them create one under theirs.
Who is affected
Any developer choosing a credential for a store integration, or sharing a PAT with a third-party developer. This is additive guidance; no API or scope behavior changed.
Links
- About authentication — credential chooser and PAT scopes
- How to authenticate — PAT generation and hygiene
Last updated on
How is this guide?