The Shoffi Partner Token Leak

What we know

Shoffi — a Shopify affiliate-program provider — has confirmed a security issue that exposed Shopify Partner API tokens it held on behalf of some of its customers. This is a confirmed leak, disclosed by Shoffi itself:

• Shoffi says a security review identified and fixed an issue that, in certain cases, could have allowed Shopify Partner API tokens associated with certain apps to be retrieved. Some partners’ keys were exposed.
• As a precaution, Shoffi has asked all customers to rotate their Partner API tokens, strengthened internal controls, rotated its own internal credentials, and notified Shopify’s security team.
• By its own account, Shoffi has no evidence any token was actually accessed or misused — but the nature of Partner API tokens means it cannot independently determine whether that happened.

The timeline above is the running record. We’ll update it as more surfaces.

What we don’t know — including how

The leak is confirmed; the mechanism is not. Shoffi hasn’t disclosed a root cause, and we won’t invent one — though its own wording does point to a likely shape, which we flag (clearly caveated) in the next section. None of this is an accusation.

• How the tokens were exposed is not public. Shoffi hasn’t disclosed how bad actors could have accessed the tokens it held — no root cause, attack vector, storage detail, or exposure window. We won’t invent one.
• Whether any token was actually accessed is unknown — by Shoffi’s own account, the nature of Partner API tokens means it cannot independently determine whether misuse ever happened.
• The original anonymous report is unverified, and Shoffi says it has no evidence connecting that post to the issue it found. The two may or may not be related.

This section stays until those blanks are filled by a first-party source. If you have verifiable detail, we’ll update the record — not the rumor mill.

Our read: this has the shape of broken authorization

Shoffi hasn’t named a root cause, so what follows is inference — but it’s inference from their own words, not the rumor mill. Read the key line again:

“we identified and fixed an issue that, in certain cases, could have allowed Shopify Partner API tokens associated with certain apps to be retrieved”

In a multi-tenant service holding many customers’ tokens, “tokens associated with certain apps could have been retrieved” is the signature of a broken authorization flaw: a request that’s properly authenticated — a real, logged-in user — but not properly authorized, able to read token records that belong to someone else. Change or guess an identifier, get back a credential that isn’t yours. It’s the same class as IDOR / broken object-level authorization.

To be clear: this is our assessment, not a cause Shoffi confirmed. Based on the information we’ve seen it’s the most likely shape of the bug — but Shoffi has not disclosed the mechanism, and nothing here is an accusation. They found the issue and fixed it.

The update: remediated, tested, and rethinking the token model

On August 18, Shoffi sent us an official statement for the timeline (above). The short version: the vulnerability is remediated, and they’ve completed an independent penetration test covering the app, APIs, authentication and authorization, token handling, and tenant isolation — with the originally-vulnerable area in scope.

Two things stand out.

Still no named root cause. The statement confirms a fix and a pen-test but doesn’t describe the vulnerability itself — so our read (above) stands: the shape of it, one tenant able to retrieve another’s tokens, points to a broken-authorization / privilege flaw. Speculation, clearly labelled — and the exact class we break down in the Authorization field guide.

They want to stop holding your token at all. The forward-looking part is the most interesting. Shoffi says it’s reworking its Partner API integration to reduce or eliminate the need to hold broadly-scoped Partner API credentials, through one of:

• a narrower permission model, if Shopify can scope Partner API access down to just the data Shoffi needs;
• a server-to-server REST API, where partners push only the required data to Shoffi and never hand over their Partner API token;
• a partner-hosted package or connector, keeping the Shopify credential entirely inside the partner’s own infrastructure.

This is the right direction, and the lesson generalizes well past Shoffi: the root risk is handing a broadly-scoped credential to a third party at all. Each option shrinks the blast radius by keeping the token on your side of the fence. If you build integrations that ask partners for Partner API tokens — or you’re the partner being asked — treat don’t hold the credential as the goal and least privilege as the floor.

Partner API vs Admin API — what’s actually at risk

The single most important thing to get right: this involves the Shopify Partner API, which is a completely separate interface from the Shopify Admin API.

• Partner API — reads and manages your Partner organization: your apps, their installs/uninstalls and charges, and your payout/financial data. Scopes like manage_apps and view_financials gate that access, and Shopify has been steadily expanding what Partner-side scopes can do.
• Admin API — the interface to merchant data: orders, customers, products, collections. This is not affected. A Partner API token cannot read a store’s orders or customers.

So the blast radius is your app catalog and your financials — plus what those leak about the merchants who install you — not merchant PII directly.

flowchart TD
    T([If a Partner API token<br/>is exposed]) --> P[Shopify Partner API]:::bad
    P --> S1["manage_apps —<br/>installs, uninstalls, charges"]:::bad
    P --> S2["view_financials —<br/>payouts, transactions, earnings"]:::bad
    T -. no path .-> A[Shopify Admin API]:::good
    A --> C["Merchant data —<br/>orders, customers, products"]:::good
    classDef bad  fill:#1a0f0f,stroke:#FF5F56,color:#FF5F56;
    classDef good fill:#0d1a12,stroke:#7CF9A0,color:#7CF9A0;

That separation is the good news. The bad news is that a Partner API token is a bearer credential used directly against Shopify — which is exactly why Shoffi says it can’t independently tell whether one was ever misused. There’s no per-app audit trail handed back to you.

If you use (or ever used) Shoffi

Treat the token as potentially exposed and rotate it. Deleting it outright is even better if you no longer need the integration.

The precise steps Shoffi is recommending:

1. In your Shopify Partner Dashboard, generate a new Partner API token.
2. In Shoffi, go to My Apps → Edit App → Edit Token and save the new token.
3. Once the new token is confirmed working, revoke the previous token from your Partner account.
4. While you’re in there, audit every Partner API client — delete any you don’t recognize or no longer use.

Then reduce the next blast radius:

• Grant Partner API clients the minimum scopes they need. If a service only reads financials, it doesn’t need manage_apps.
• Keep an inventory of which third parties hold which tokens, so the next “rotate everything” takes minutes, not archaeology.
• The Admin API is unaffected here — but the same discipline (rotate on exposure, least privilege) is what keeps that surface clean too.

Straight from Shopify

• Partner API reference — what the Partner API exposes and the access scopes (manage_apps, view_financials, and more) that gate it; note it’s org-scoped and separate from the Admin API.
• Shopify API access scopes — the scope model in general; grant the minimum a client needs.
• About client credentials — why credentials must stay secret, and the principle of rotating them on any suspected exposure.
• Rotate or revoke client credentials — the mechanics of rolling a credential without downtime.