Storefront API explained for store owners
The interface that lets a custom site, app or content page read your products and build carts, what it can and cannot do, and how it stays safe.
The short answer
The storefront API is the public-facing interface of your store. Any site, app or device with a storefront token can read your products, collections, prices and availability, create a cart for a visitor, add and remove items, and hand that cart to Shopify’s checkout. It is designed to be customer-safe: it cannot change products, read orders or other customers’ data, or touch the admin, which is why its token can be used in a browser. It is the piece that makes a headless storefront, a content site with live product cards, a mobile app or an in-store kiosk possible without a second catalogue. Everything they show comes from the store you already manage.
What it can and cannot do
| Can | Cannot |
|---|---|
| Read products, variants, images, prices, availability | Change products or prices |
| Read collections and their products, with filters and sorting | Read orders, customers or payouts |
| Read content: pages, articles, menus, metafields marked for storefront | Change store settings |
| Create and manage a visitor’s cart | See another visitor’s cart |
| Apply discount codes to a cart | Create discounts |
| Provide the checkout address for a cart | Process payment itself; checkout does that |
| Serve market-specific prices, currencies and languages | Configure Markets |
| Authenticate a customer for their own account data, with the customer’s login | Access accounts without login |
How a storefront uses it well
- Build pages ahead of time from the API at deploy time, so product and collection pages are static and fast.
- Query live for what changes: availability, the cart, market-specific prices where needed.
- Rebuild on change through webhooks from the store: a product update triggers the pages that need it.
- Keep the cart in the API, so the checkout receives it intact with discounts and market settings.
- Stay within rate limits by design: build ahead, cache, query only what is needed.
- Use the customer account features for logged-in areas rather than building your own.
What it makes possible
A storefront built with any framework, reading the catalogue you manage in the admin. A content site whose articles show live product cards. A mobile app with the same products and carts. An in-store display or kiosk. A partner’s site embedding your products. Each is one more face of one store, with one catalogue, one stock and one checkout, and none of them requires the admin to know they exist.
What this means for you
The storefront API lets your store be shown and shopped anywhere, from the catalogue you already manage, with the checkout you already trust, safely, because it exposes only what customers may see. Storefronts built on it should build pages ahead, query live only for what changes, and never confuse it with the admin API. It is the foundation under every headless and content-and-commerce setup, and understanding what it can and cannot do is enough to judge one.
Frequently asked questions
Is it safe to use the storefront API from a website's front end?
Yes, because the token is scoped to what a customer could see anyway: public products, prices, availability, and carts the visitor creates. It cannot read orders, customers or admin data or change anything in the store. The admin API, which can, is a different interface with different tokens that must never appear in a browser.
What is the difference between the storefront API and the admin API?
The storefront API serves customers: read the catalogue, build a cart, go to checkout. The admin API serves the business: manage products, read orders, update inventory, configure the store. The first is public-safe; the second is privileged and used only from servers and apps under strict access. Confusing the two is a security mistake.
Does using the storefront API cost anything?
It is included with the store, with rate limits that a well-built storefront stays well within by building pages at deploy time and querying only for carts and live data. A storefront that queries the API on every page view for every visitor is both slower and closer to the limits than one that builds pages ahead and fetches only what changes.
Sources
- Shopify developer documentation: Storefront API (accessed 2026-09-12)