Workflow FunctionsWorkflow Functions

Developer API and MCP

Everything you can do in the app, you can also do from your own code or from an AI agent. Workflow Functions exposes two surfaces: a REST API and an MCP server. Both live on the Developer page.

API keys

Both surfaces authenticate with an API key. On the Developer page, under API keys, create a key and pick its level:

  • Read only - list and read functions and runs.
  • Read & write - also create, update, delete, and run functions.

The full key is shown once, at creation. Copy it then and store it securely; you cannot see it again. Keys are stored hashed, never in plain text, and you can revoke a key at any time.

Send the key as a Bearer token on every request:

Authorization: Bearer ffk_your_key_here

Replace ffk_your_key_here with the key you created on the Developer page.

REST API

The base URL is https://shopify.workflow-functions.app/api/v1 (also shown on the Developer page). The main endpoints:

Method Path Purpose
GET /api/v1/me Check auth and see your key's level
GET /api/v1/functions List functions
POST /api/v1/functions Create a function
GET /api/v1/functions/:id Get one function
PUT / PATCH /api/v1/functions/:id Replace or update a function
DELETE /api/v1/functions/:id Delete a function
POST /api/v1/functions/:id/run Run a function now
GET /api/v1/runs List runs
GET /api/v1/runs/:id Get one run

A quick check that your key works:

curl https://shopify.workflow-functions.app/api/v1/me \
  -H "Authorization: Bearer ffk_your_key_here"
{ "authenticated": true, "shop": "your-store.myshopify.com", "level": "WRITE" }

MCP server

The MCP server lets an AI agent (Claude, Cursor, VS Code, Gemini CLI, and others) manage and run your functions directly. On the Developer page, the MCP tab shows:

  • The MCP server URL: https://shopify.workflow-functions.app/api/mcp.
  • A ready-to-copy connect command per client, with your key already inserted.

The MCP tools mirror the REST endpoints, and the tool set reflects your key's level: a read-only key exposes only read tools. All authentication and data handling stay server-side.

API and MCP runs do not use your Flow quota

Runs you trigger through the REST API or MCP are recorded as API runs. Like manual test runs, they do not count against your plan's monthly run quota. Only runs triggered by Shopify Flow (and scheduled runs) count. This makes the API safe to use for building, testing, and automation without eating into your allowance. See Run history and troubleshooting for how run triggers appear in history.

Bans and rate limits

The API enforces the same safety controls as the app. It is rate limited with a leaky-bucket model - the same approach Shopify uses: a burst of up to 300 requests per key, refilling 5 per second (the run endpoint is 60 burst, 1 per second). Going over returns 429 with a retry time, so back off and retry (ideally with exponential backoff). Limits are the same on every plan. Keys are level-enforced on every call, and a suspended store cannot run functions over the API any more than it can from Flow.

The API is versioned in the path (/api/v1); a breaking change would ship as /api/v2 with notice, and v1 keeps working.

Next steps

Shopify's own limits

These are Shopify's limits on Shopify's APIs, not ours. They apply to what this app (and your workflows) can do on the Shopify side, and you may meet them on a large store even while well inside our limits.

  • Input arrays are capped at 250 items across every Shopify API. A request with a larger array is rejected.
  • Pagination stops at 25,000 objects. Counts are accurate up to 25,000; above that Shopify returns 25001, meaning "more than 25,000". If you need to go deeper, filter first.
  • The GraphQL Admin API is metered by calculated query cost, in points per second, and the ceiling depends on the store's Shopify plan:
Shopify plan Points per second
Standard 100
Advanced 200
Plus 1000
Enterprise (Commerce Components) 2000

The Storefront API is not rate limited.

Full detail: Shopify API rate limits