Leaked API Keys in a Shopify Theme: How to Check and What to Do
Theme code is public to every visitor. A key pasted into it is public too. How to look for secrets in your theme, which ones matter, and how to rotate them.
By The Appnary Team
A Shopify theme is sent to every visitor's browser. Liquid runs on Shopify's servers, but what it outputs, and every JavaScript file in the theme assets, is readable by anyone who opens developer tools. A secret pasted into a theme is not a secret.
It happens more than it should. A developer tests an integration, pastes a token into a snippet, and moves on. An agency hard-codes a key so a feature works. An old app leaves its configuration behind.
What is fine to have in a theme
Some values are designed to be public. A Storefront API access token is meant for use in the browser. Analytics measurement IDs and ad pixel IDs are public identifiers. Finding these is not a leak.
What is not
- Admin API access tokens. Shopify's Admin API tokens commonly begin with shpat_. They grant access to store data and settings. They belong on a server and nowhere else.
- API secret keys and shared secrets for apps or webhooks.
- Keys for third-party services that charge per use or can read data: email, SMS, mapping, payment, or AI services.
- Passwords or credentials of any kind in a comment or a snippet.
How to check
In the theme code editor, search for terms such as token, secret, api_key, apikey, password, and bearer. Search for the prefix shpat_. Open the matches in JavaScript files under assets and in snippets that print values into script tags. Then look at the live storefront's page source, because an app can inject a value that is not in the theme files.
If you find one
1. Treat it as exposed from the day it was first added, not the day you found it. 2. Rotate it. In the service or app that issued it, generate a new key and revoke the old one. Removing it from the theme does not make the old key safe. 3. Check what that key could access and whether anything unexpected happened with it. 4. Move the new key to a server or to an app that holds it, and take it out of theme code.
Make it a routine
Search the theme after every developer or agency change, and before you hand a theme to someone else. Also see how to remove leftover app code, since old integrations are where forgotten keys tend to live.
Vigil is our scanner for this. It is in development, not on the Shopify App Store yet, and it cannot be installed today. Read what it checks or join the waitlist. It flags secret-looking strings in theme code and embeds and names the file, without showing the secret itself.