A public Storefront API token is meant for browsers and mobile apps, where buyers can see it. A private token is meant for servers and must never reach client code. In a headless build, put public tokens in the front end and keep private tokens in server-side code only.
What the two token types are
Shopify's Storefront API documentation describes two access modes. Public access is used to query the API from a browser or mobile app, where the token is visible to buyers. Private access is used from a server or other private context, such as a Hydrogen backend, where the token stays secret. The documentation adds that private tokens should be treated as secret and not used on the client side.
The docs also note that tokenless access exists for essential features such as products, collections, search and the cart. So a basic catalog front end may not need a token at all.
Which token goes where
| Where the code runs | Token to use | Visible to buyers? |
|---|---|---|
| Browser or mobile app | Public token | Yes, assume so |
| Server rendering, API route, backend for frontend | Private token | No |
| Build step that fetches catalog data | Private token | No, if it never lands in the bundle |
The risky case is the last row. A build tool that inlines a variable into the JavaScript bundle turns a private token into a public one. See our note on which Next.js variables end up in the browser.
Steps to check your own build
- List every Storefront API token your project uses and mark each as public or private.
- Search the built JavaScript output, not just the source, for the private token value or its header name.
- Confirm private tokens are read only in server code paths, and that the header they use is never set from a browser.
- Request only the scopes the front end needs. Shopify recommends limiting scopes to reduce the security risk.
- Rotate any private token that appeared in a bundle, a log or a public repository.
Why the distinction matters
A public token exposed on purpose has a small blast radius, because it can only do what its scopes allow. A private token pasted into client code has the same visibility but may carry broader access. Treat the scopes as the real control, and the token type as a reminder of where the value is allowed to live.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a scan flags a secret that sits in source code before it ships.
Safeguard can scan repositories for hard coded secrets and dependency issues, and you can try the free scan at gold.safeguard.sh/scan.
Quick check
Is a public Storefront API token a secret?
No. Shopify describes it as the token used where buyers can see it. Limit its scopes and do not reuse it for server tasks.
Can a headless store skip tokens entirely?
For essential features such as products, collections, search and cart, tokenless access is documented. Other features need a token.
Sources
Last reviewed: 19 October 2026.
