How nullcipher recognises it
Checked only when the text contains “shpat_” (any case). Pattern (gitleaks rule shopify-access-token, v8.30.1, translated to JavaScript): /shpat_[0-9A-Fa-f]{32}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone.
This is the rule text of the “Shopify access token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.
The same page covers 3 more rules, each with its own placeholder:
- Shopify custom access token — [SHOPIFY_CUSTOM_ACCESS_TOKEN_1]
- Checked only when the text contains “shpca_” (any case). Pattern (gitleaks rule shopify-custom-access-token, v8.30.1, translated to JavaScript): /shpca_[0-9A-Fa-f]{32}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)
- Shopify private app access token — [SHOPIFY_PRIVATE_APP_ACCESS_TOKEN_1]
- Checked only when the text contains “shppa_” (any case). Pattern (gitleaks rule shopify-private-app-access-token, v8.30.1, translated to JavaScript): /shppa_[0-9A-Fa-f]{32}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)
- Shopify shared secret — [SHOPIFY_SHARED_SECRET_1]
- Checked only when the text contains “shpss_” (any case). Pattern (gitleaks rule shopify-shared-secret, v8.30.1, translated to JavaScript): /shpss_[0-9A-Fa-f]{32}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)
Example (fake)
# EXAMPLE, not a real token
SHOPIFY_ADMIN_API_TOKEN=shpat_0123456789abcdef0123456789abcdefnullcipher replaces it with [SHOPIFY_ACCESS_TOKEN_1]. The 32 hex digits are 0-f twice. Shopify never issued it.
Why it matters in an AI chat
An Admin API access token opens the store's back office to whatever scopes the app was granted: orders with customer names and addresses, products and prices, and often discounts and fulfilment. A leaked token therefore exposes your customers' personal data, not just your catalogue.
Shopify's documentation says an access token stays pinned to the client secret that minted it, and tokens still pinned to a revoked secret stop working — so the fix is at the secret, not the individual token.
Tokens travel in theme-deploy scripts, webhook handlers and CI variables that get pasted into AI chats during debugging.
If it already leaked
- For an app in the Dev Dashboard: Shopify's credential guide says that if a secret is actively being misused, revoke the exposed client secret immediately, before generating a new one — merchants lose access until the new secret is in place, but the leaked credentials stop working. Any access token still pinned to the revoked secret stops working. [1]
- For routine rotation without downtime, follow the same guide's order: Settings → Credentials → Rotate next to the client secret, update webhook validation and the app, re-pin stored access tokens to the new secret, then revoke the old one. [1]
- For a custom app created in the Shopify admin, Shopify notes there is no way to rotate its secret; the merchant uninstalls and reinstalls the app to get new credentials. [1]
Sources
- Manage your app's credentials — Shopify.dev — checked 2026-09-25.
Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.