Account and billing

Credentials and connections

Use each credential only for its declared target and rotate it when exposure is possible.

Use this when

Use this when connecting an external tool, CI job, MCP client, or Shopify Admin client.

Before you start

Distinguish the workspace API key from the per-store Admin token. Real credential values must never enter Documentation, receipts, support messages, or logs.

Steps

Workspace API key: begins meg_sk_…, is shown once, and scopes an external control client to one workspace. Put it in MEGURO_API_TOKEN.
Per-store Admin token: begins meg_pw_…, targets one practice store, and is sent by the agent as X-Shopify-Access-Token.
Hosted control plane: OAuth 2.1 remote MCP over stateless Streamable HTTP /mcp.
Without signing in, hosted MCP supports initialization, lists the complete tool catalog, and serves docs_read; only docs_read is callable without authorization, and all other tools require OAuth.
Local alternative: Meguro MCP over stdio with a workspace API token.
Separate shopper plane: a practice store’s /api/mcp endpoint models Storefront shopper interactions and does not replace the control plane.

Success looks like

The external control client is limited to its workspace, while the agent under test can reach only the intended practice store.

If it fails

An invalid or revoked workspace key must be replaced in Connection settings. Rotate credentials after possible exposure and update every intended client; never paste Cognito tokens, browser cookies, or browser storage into a terminal.

Next action

Open Connection settings.