Shopify CLI / App developmentAction Required

App automation token
CI/CD automated deployment is now open to all apps

Using an "app-scoped" token issued in the Dev Dashboard, you can now automate app releases from GitHub Workflows and the like with the latest Shopify CLI. It replaces the old CLI token that was issued in the Partner Dashboard.

On this page
  1. What's actually changing (in 30 seconds)
  2. How it works: the flow from push to deploy
  3. What is an App automation token
  4. Old CLI token vs App automation token
  5. Deployment steps (3 steps)
  6. Migration notes (Action Required)
  7. 5 key points for developers
  8. 3 practical use cases
  9. A one-line summary for proposals

1What's actually changing

From CI/CD (such as GitHub Workflows), automated app deployment is now available for all apps.
The key is the token you issue in the Dev Dashboard: App automation token (an app-scoped authentication token). With it, you can automate app releases using the latest Shopify CLI.

Before: Partner Dashboard CLI token

Deploying from CI used a CLI token issued in the Partner Dashboard. Its authentication scope was not per-app.

From now on: App automation token

Issued in the Dev Dashboard, an app-scopedtoken. Because each token is tied to an individual app, security and control are improved.

2How it works: the flow from push to deploy

Repository App code push / merge GitHub, etc. GitHub Workflow SHOPIFY_APP_AUTOMATION_TOKEN Latest Shopify CLI Run Pass the token as an environment variable $ shopify app deploy --config production --allow-updates deploy command Release applied App update goes live
The key point is simply "put the token in an environment variable → run the CLI's deploy command". With just these two in place on a CI runner, app releases run without any manual login.
* The article uses GitHub Workflows as an example, and notes it also works with "similar tools."

3What is an App automation token?

Per-app authentication

App-scoped authentication. Since each token is limited to a single app, its scope of impact is narrow.

Issued in the Dev Dashboard

Tokens are issued and managed in the Dev Dashboard (replacing the legacy Partner Dashboard issuance).

Improved security and control

Isolating tokens per app improves security and controllability (as stated in the article).

This makes "app deployment in CI/CD" available for all apps. Use it together with the latest Shopify CLI.

4Legacy CLI token vs. App automation token

ItemOld: CLI tokenNew: App automation token
Where it's issued Partner Dashboard Dev Dashboard
Auth scope Not per-app Per-app (app-scoped)
Current status Continues to work until it expires Recommended for new use and as the migration target
Recommended action Migration required Migration recommended for security and functionality reasons
Applicable apps — All apps
The legacy CLI token'sspecific expiration date or migration deadlinein the article is not stated. Only the phrasing "works until it expires" is given. Check the migration guide on Shopify.dev for details.

5Deployment steps (3 steps)

1

Issue a token

Issue an App automation token for the target app in the Dev Dashboard.

2
export

Set it as an environment variable

SHOPIFY_APP_AUTOMATION_TOKEN and pass it to CI.

3

Run the deploy command

shopify app deploy Running it applies the release.

# Set the token as an environment variable export SHOPIFY_APP_AUTOMATION_TOKEN="your-app-automation-token" # Run the deploy shopify app deploy --config production --allow-updates

* The above is the command exactly as written in the article.--config production specifies the configuration to deploy, and--allow-updates specifies that the update be applied.

6Migration notes (Action Required)

Current state

Existing CLI tokens still work for now

CLI tokens already issued in the Partner Dashboardcontinue to work until they expire. They don't stop working immediately.

Recommended

Migrate to an App automation token

Migrating to an App automation token is recommended to improve security and functionality. The article includes a link to a "migration guide."

Reference docs listed at the end of the article (Shopify.dev):
Managing app automation tokens(Managing App automation tokens)
Deploy app components in a CD pipeline(Deploying app components in a CD pipeline)
Migration guide(Learn more about migrating to app automation tokens)

7Five points engineers should keep in mind

1. Tokens are "per app"

Because authentication is app-scoped, one token equals one app. The blast radius of a leak is limited to an individual app, and the design prevents touching multiple apps with the same token.

$ CLI

2. "The latest Shopify CLI" is required

The article explicitly states to use "the latest Shopify CLI." Keep the CLI version in CI up to date. An explicit minimum required version number is not stated.

3. Pass it via an environment variable

SHOPIFY_APP_AUTOMATION_TOKEN Pass it via this environment variable. With GitHub Actions, the natural approach is to store it in Secrets and expand it when the job runs.

--config / --allow-updates

4. The deploy flags

The example uses --config production and --allow-updates together. It demonstrates a workflow that explicitly specifies the configuration name and applies updates.

5. Old CLI tokens last "until they expire" — replace them as planned

Existing CLI tokens created in the Partner Dashboard work until they expire, but they will eventually lapse.Switching to an App automation token in a planned way before expiration suddenly halts your deploysis the safe approach. A specific expiration date or deprecation schedule is not statedin the article, so check the migration guide.

8Three practical use cases

git merge → main CI deploy Automated releases
USE CASE 1

Auto-deploy the production app on merge to main (eliminating manual releases)

Challenge
Until now, app releases were done manually by a staff member from their own machine, shopify app deploy which led to key-person dependency, missed steps, and late-night work.
Approach
Register an App automation token in Secrets, and in a GitHub Workflow triggered by a merge to main, run shopify app deploy --config production --allow-updates .
Result
Releases become automated and standardized. Deployments run reliably with the same steps from anyone's machine, and the release history is recorded in CI.
Technical notes
Keep the Shopify CLI on CI up to date. Since tokens are per-app, issue one specifically for the production app and isolate it in Secrets.
App A App B token A token B Isolate per app
USE CASE 2

Permission separation across multiple apps & stronger pipeline security

Challenge
When you run multiple apps, having a single broad token that can touch several apps widens the blast radius if it leaks and makes auditing harder.
Approach
Issue an app-scoped App automation token for each app, and assign each CI/CD pipeline only the token for its corresponding app.
Result
Least privilege. If one app's token leaks, it doesn't spread to other apps, and you can manage issuance and revocation per app.
Technical notes
See the "Managing app automation tokens" guide for issuing and managing tokens. Combine it with separating Secrets per repository/environment.
Old token New token Expired Migration complete Replace before expiry
USE CASE 3

Planned migration from the old CLI token

Challenge
Your CI is built on a CLI token issued from the Partner Dashboard, but it will eventually expire. You want to avoid the risk of releases suddenly stopping when it does.
Approach
Following the migration guide, issue an App automation token → swap the CI Secrets to the new token → stop using the old token after verifying everything works.
Result
Eliminates the risk of downtime from expiry and completes the migration to the recommended new approach (improved security and functionality).
Technical notes
The article doesn't state a specific expiry date. Check the deadline and steps in the migration guide (migrating to app automation tokens) before getting started.

9A one-line summary you can use in a pitch

"The Dev Dashboard's App automation token (per-app authentication) now unlocks automated CI/CD deployment for all apps.
Set the token as an environment variable and shopify app deploy — that's all it takes.
Legacy CLI tokens from the Partner Dashboard remain usable until they expire, but migrating early is recommended for better security."