Flow Functions

Developer API and MCP

Everything you can do in the app, you can also do from your own code or from an AI agent. Workflow Functions exposes two surfaces: a REST API and an MCP server. Both live on the Developer page.

API keys

Both surfaces authenticate with an API key. On the Developer page, under API keys, create a key and pick its level:

  • Read only - list and read functions and runs.
  • Read & write - also create, update, delete, and run functions.

The full key is shown once, at creation. Copy it then and store it securely; you cannot see it again. Keys are stored hashed, never in plain text, and you can revoke a key at any time.

Send the key as a Bearer token on every request:

Authorization: Bearer ffk_your_key_here

REST API

The base URL is shown on the Developer page as .../api/v1. The main endpoints:

Method Path Purpose
GET /api/v1/me Check auth and see your key's level
GET /api/v1/functions List functions
POST /api/v1/functions Create a function
GET /api/v1/functions/:id Get one function
PUT / PATCH /api/v1/functions/:id Replace or update a function
DELETE /api/v1/functions/:id Delete a function
POST /api/v1/functions/:id/run Run a function now
GET /api/v1/runs List runs
GET /api/v1/runs/:id Get one run

A quick check that your key works:

curl https://your-app-url/api/v1/me \
  -H "Authorization: Bearer ffk_your_key_here"

{ "authenticated": true, "shop": "your-store.myshopify.com", "level": "WRITE" }

MCP server

The MCP server lets an AI agent (Claude, Cursor, VS Code, Gemini CLI, and others) manage and run your functions directly. On the Developer page, the MCP tab shows:

  • The MCP server URL (.../api/mcp).
  • A ready-to-copy connect command per client, with your key already inserted.

The MCP tools mirror the REST endpoints, and the tool set reflects your key's level: a read-only key exposes only read tools. All authentication and data handling stay server-side.

API and MCP runs do not use your Flow quota

Runs you trigger through the REST API or MCP are recorded as API runs. Like manual test runs, they do not count against your plan's monthly run quota. Only runs triggered by Shopify Flow count. This makes the API safe to use for building, testing, and automation without eating into your allowance. See Run history and troubleshooting for how run triggers appear in history.

Bans and rate limits

The API enforces the same safety controls as the app. Requests are rate limited, keys are level-enforced on every call, and a suspended store cannot run functions over the API any more than it can from Flow.

Next steps