You built a Custom GPT to act as a customer support agent or internal assistant. You want it to check inventory or create draft orders, so you create an Action in OpenAI. Most tutorials tell you to generate a Shopify Admin API token and paste it directly into the GPT authentication settings.

This works, but it puts your entire store at risk. A Custom GPT is a chatbot wrapped around an API client. If you give it your main Shopify key, anyone talking to that GPT might be able to steal the key and take control of your store.

1. Prompt injection exposing the headers

Users can tell a GPT to ignore its previous instructions. They can type a prompt asking the AI to print the exact HTTP headers it sends when making an API request. Since OpenAI injects your Shopify token into those headers to authenticate the action, the GPT will often just print your raw token on the screen.

Once a malicious user has your Shopify Admin API token, they have the same access your GPT does. If the token has broad permissions, the user can download your customer list, delete products, or change prices directly via the Shopify API.

Fix: Put a middleman between OpenAI and Shopify. This is usually a small piece of code running on Cloudflare Workers, Vercel, or a basic Node.js server. You give this middleware server your real Shopify Admin token. You store it securely as an environment variable so it never reaches the browser or the OpenAI servers. Then, you invent a new, random password. You give this random password to the Custom GPT in the Authentication settings.

2. Unrestricted API access

If your middleware just takes whatever the GPT sends and forwards it to Shopify, you still have a problem. The AI might hallucinate a destructive command, or a user might trick the AI into passing a delete command through your middleware.

Fix: Hardcode the allowed actions. Do not let the GPT send raw GraphQL or REST queries. Instead, write specific endpoints on your middleware.

Create an endpoint like /get-stock-level. Tell the Custom GPT to send a product ID to that endpoint. Have your middleware read the product ID and construct the exact Shopify API call needed to fetch the stock. Return only the stock number to the GPT.

This guarantees the AI can only perform the actions you explicitly programmed. Even if the user tricks the GPT, the GPT can only hit the /get-stock-level endpoint.

3. Dealing with a leaked middleware password

If a user tricks the GPT into printing its headers after you set up middleware, they will only see the random password you invented. Your Shopify store remains safe because the real token is hidden on your server.

However, the user could still use that random password to spam your middleware endpoints outside of ChatGPT.

Fix: Revoke the middleware password. Since you control the middleware, you generate a new random password, update your server environment variables, and paste the new password into the OpenAI action settings. The attacker's access is cut off, and your Shopify integration does not need to be rebuilt.

Still stuck?

Setting up a middleware server requires writing code and managing hosting. If you need a secure bridge between your AI tools and your database, this is the kind of fix I do.

FAQ

Can a Custom GPT hide its API keys?

No, the API keys stored in a Custom GPT action can often be revealed through prompt injection. You should never put a high-privilege API token directly into OpenAI.

Why shouldn't I use the Shopify Admin API directly in OpenAI?

The Shopify Admin API token gives direct control over your store data. If the GPT leaks this token, an attacker can read your customer data or modify your products.

What is middleware for an API?

Middleware is a small server you control that sits between two services. It receives the request from the first service, validates it, and then forwards it to the second service using hidden credentials.

Originally published at watershowdigital.com/blog/safely-connect-openai-custom-gpt-shopify-api. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.