Frequently asked questions

Yes. Flow is what runs your automation; Workflow Functions adds a Run Function action to it so a workflow can execute your code. Flow is free from Shopify. See Set up the Run Function action in Shopify Flow.

JavaScript or TypeScript. Each function exports a default async function that receives (input, ctx) and runs in a secure, isolated sandbox. See How to create a function.

No. Only runs triggered by Shopify Flow count against your rolling 30-day quota. The Test button in the editor (recorded as Manual) and runs through the REST API or MCP (recorded as API) are free. A Flow run that fails before your code executes has its quota slot refunded. See Run history and troubleshooting.

Every plan includes all features and unlimited functions - they differ only in how many Flow-triggered runs you get per rolling 30 days: Free 500, Starter 5,000, Grow 15,000, Unlimited unlimited. You can watch usage on the dashboard and get emailed at 80% and 100%.

Turn on Needs Shopify data for the function, grant the matching permissions on the Permissions page, then call ctx.shopify.graphql(query, variables) in your code. Your store's access token stays on our server and never enters the sandbox, so it cannot leak into your input, logs or output. See Permissions and store data access.

Shopify puts the whole Customer object behind its protected customer data program, so reading it - even just a customer id - needs an app-level approval that is separate from granting the customers permission in the app. Products, orders and discounts are not affected. If a function needs customer data and hits this error, Support and we will help - it is not something the Permissions page alone can switch on. See Permissions and store data access.

Yes. Store them as Secrets and read them in code as secrets.MY_KEY. Secrets are encrypted at rest, never shown again after you save them, and their values are masked out of logs, output and run history - so a function can use a secret without ever exposing it. See Creating and using secrets.

Anyone with access to the app in your Shopify admin can view and edit every function's code - treat it as shared team code, not a private vault. Keep anything sensitive (API keys, tokens, passwords) in Secrets rather than hard-coded in the source; secret values stay masked everywhere. See Creating and using secrets.

Yes. Use ctx.fetch(url, options) for outbound HTTP from inside your function - for example to post to Slack, call your own backend, or hit a third-party service. Use ctx.log(...) to record what happened; the lines show up on the run detail.

Test runs the code currently in the editor against the sample input on the Test tab (recorded as Manual, no quota). A real run uses the saved function and whatever input Shopify Flow sends it. A green test proves your code works; it does not prove the Flow action is wired up correctly, so run the workflow once for real and check History. See Run history and troubleshooting.

You revoked a permission it uses. Revoking a scope automatically disables the functions that depend on it, so they cannot fail half-way through; grant the permission again and they re-enable on their own. You can also toggle Enabled yourself on a function's Settings tab. See Permissions and store data access.

Templates you save are private to your store for now - sharing them publicly between stores is coming. The Verified templates from Code Creation Labs are available to every store as a ready-made starting point. See Using templates.

Set the timeout (up to 30 seconds) and memory (up to 512 MB) per function on its Settings tab. A run that exceeds its timeout is recorded as Timeout - usually a slow external call or an endless loop. See Run history and troubleshooting.

Yes. The Developer page issues API keys for a REST API and an MCP server, so you can list, create, update and run functions from a script or an AI agent. Runs started this way are marked API and do not count against your Flow quota. See Developer API and MCP.

No. If Flow retries the same action execution, we recognise the duplicate and return the earlier result instead of running your code again - so side effects (like creating a discount) do not repeat, and it does not cost a second quota slot. See Set up the Run Function action in Shopify Flow.

In the EU, encrypted at rest. Secrets get an additional layer of envelope encryption through a dedicated key-management service, are never stored in plaintext, and never appear in run history. Function input and output are kept in History so you can debug and re-run.