# The Shoffi Partner Token Leak

> Shopify affiliate program provider Shoffi has reported a data leak of Shopify Partner Access tokens it held.

**Severity:** crit · **Status:** monitoring · **Vendor:** Shoffi · **Exposed:** Shopify Partner API tokens

**Surfaced:** 2026-08-08 · **Updated:** 2026-08-11 · **Tags:** partner-api, tokens, third-party, shoffi, authorization

_Source: https://verybadpanda.dev/incidents/shoffi-partner-token-exposure_

## Timeline

### 2026-08-08 — Anonymous developer reports a leaked token

An anonymous Shopify app developer posts in the **Shopify App Founders** Facebook group, claiming their Shoffi Partner API token was leaked. No further context or evidence is provided.

### 2026-08-08 — Founder's first response downplays the report

Within 24 hours of being tagged on an [X thread](https://x.com/haritanitay/status/2085961690810614231), Shoffi's founder responds — pointing to five clean years and arguing a token isn't Shoffi's alone to leak.

> I don't know who this person is, but in the 5 years we've been running Shoffi, we haven't had any complaints about an access token or data leak. We take data protection very seriously and check our systems frequently.
>
> It's also important to note that even if this anonymous person's key was compromised, it could have been through any other service or through the partner account.
>
> The fact that you created an access token for Shoffi doesn't mean it's only ours to use. If it was stored or sent to someone on the team unsafely, anyone could use it to retrieve data from your partner account.

[X — @haritanitay](https://x.com/haritanitay/status/2085961690810614231)

### 2026-08-09 — Founder posts a public correction

Roughly two hours after the first reply, Shoffi's founder returns to the [same X thread](https://x.com/haritanitay/status/2086373879879028753) and corrects the record. The review is complete; an issue was found and fixed; all customers are asked to rotate.

> Quick update here because we want to be transparent and correct my earlier reply based on the additional information we have now.
>
> As part of a broader security review, we identified and fixed an issue that, in certain cases, could have allowed Shopify Partner API tokens associated with certain apps to be retrieved.
>
> We have not received any evidence showing that a Partner API token was actually accessed or used without authorization, and we have no evidence connecting the issue we identified to the original anonymous post.
>
> As a precaution, we've asked all Shoffi customers to rotate their Partner API tokens. We've also strengthened the relevant security controls and notified Shopify's security team.

[X — @haritanitay](https://x.com/haritanitay/status/2086373879879028753)

### 2026-08-09 — Shoffi emails select customers directly

A "Security update" email goes out to select customers, mirroring the public correction and walking through token rotation step by step. The line that stands out is the honest one about detection:

> We have not received any evidence showing that a Partner API token was accessed or used without authorization. However, due to the nature of the issue and the way Partner API tokens can be used directly with Shopify, we are not able to independently determine whether this may have occurred in the past.

---

## What we know

Shoffi — a Shopify affiliate-program provider — has **confirmed a security issue that exposed Shopify Partner API tokens it held** on behalf of some of its customers. This is a confirmed leak, disclosed by Shoffi itself:

- Shoffi says a **security review identified and fixed an issue** that, *in certain cases, could have allowed Shopify Partner API tokens associated with certain apps to be retrieved*. Some partners' keys were exposed.
- As a precaution, Shoffi has **asked all customers to rotate** their Partner API tokens, strengthened internal controls, rotated its own internal credentials, and **notified Shopify's security team**.
- By its own account, Shoffi has **no evidence** any token was actually accessed or misused — but the nature of Partner API tokens means it **cannot independently determine** whether that happened.

The timeline above is the running record. We'll update it as more surfaces.

<Callout level="info" title="Why we're tracking this" fix="If you're a current or former Shoffi customer, rotate your Partner API token now — precaution beats regret.">
  🦝 A leaked Partner API token isn't hypothetical loot. It's a standing key to your Partner org's app and financial data. Even "we can't be sure" is reason enough to turn the lock.
</Callout>

## What we don't know — including how

The leak is confirmed; the mechanism is not. Shoffi hasn't disclosed a root cause, and we won't invent one — though its own wording does point to a likely *shape*, which we flag (clearly caveated) in the next section. None of this is an accusation.

- **How the tokens were exposed is not public.** Shoffi hasn't disclosed how bad actors could have accessed the tokens it held — no root cause, attack vector, storage detail, or exposure window. We won't invent one.
- **Whether any token was actually accessed is unknown** — by Shoffi's own account, the nature of Partner API tokens means it *cannot independently determine* whether misuse ever happened.
- **The original anonymous report is unverified**, and Shoffi says it has *no evidence* connecting that post to the issue it found. The two may or may not be related.

This section stays until those blanks are filled by a first-party source. If you have verifiable detail, we'll update the record — not the rumor mill.

## Our read: this has the shape of broken authorization

Shoffi hasn't named a root cause, so what follows is inference — but it's inference from their own words, not the rumor mill. Read the key line again:

> "we identified and fixed an issue that, in certain cases, could have allowed Shopify Partner API tokens **associated with certain apps** to be **retrieved**"

In a multi-tenant service holding many customers' tokens, "tokens associated with certain apps could have been *retrieved*" is the signature of a **broken authorization** flaw: a request that's properly *authenticated* — a real, logged-in user — but not properly *authorized*, able to read token records that belong to someone else. Change or guess an identifier, get back a credential that isn't yours. It's the same class as [IDOR / broken object-level authorization](https://verybadpanda.dev/field-guide/authorization).

**To be clear: this is our assessment, not a cause Shoffi confirmed.** Based on the information we've seen it's the most likely shape of the bug — but Shoffi has not disclosed the mechanism, and nothing here is an accusation. They found the issue and fixed it.

<Callout level="warn" title="Your app may be vulnerable to this same style of exploit" fix="define, enforce, and test the ownership checks that stop one tenant from reading another tenant's data.">
  🦝 If your app stores data or credentials for more than one merchant, ask the uncomfortable question: could one authenticated customer retrieve another's records just by changing an ID? See our <a href="/field-guide/authorization">Authorization field guide</a> for how to prevent this from happening to you.
</Callout>

## Partner API vs Admin API — what's actually at risk

The single most important thing to get right: this involves the **Shopify Partner API**, which is a *completely separate* interface from the **Shopify Admin API**.

- **Partner API** — reads and manages *your Partner organization*: your apps, their installs/uninstalls and charges, and your payout/financial data. Scopes like `manage_apps` and `view_financials` gate that access, and Shopify has been steadily expanding what Partner-side scopes can do.
- **Admin API** — the interface to *merchant* data: orders, customers, products, collections. **This is not affected.** A Partner API token cannot read a store's orders or customers.

So the blast radius is *your* app catalog and *your* financials — plus what those leak about the merchants who install you — not merchant PII directly.

```mermaid
flowchart TD
    T([If a Partner API token<br/>is exposed]) --> P[Shopify Partner API]:::bad
    P --> S1["manage_apps —<br/>installs, uninstalls, charges"]:::bad
    P --> S2["view_financials —<br/>payouts, transactions, earnings"]:::bad
    T -. no path .-> A[Shopify Admin API]:::good
    A --> C["Merchant data —<br/>orders, customers, products"]:::good
    classDef bad  fill:#1a0f0f,stroke:#FF5F56,color:#FF5F56;
    classDef good fill:#0d1a12,stroke:#7CF9A0,color:#7CF9A0;
```

That separation is the good news. The bad news is that a Partner API token is a **bearer credential used directly against Shopify** — which is exactly why Shoffi says it can't independently tell whether one was ever misused. There's no per-app audit trail handed back to you.

## If you use (or ever used) Shoffi

Treat the token as potentially exposed and rotate it. Deleting it outright is even better if you no longer need the integration.

<Callout level="warn" title="Rotate or revoke your Partner API token" fix="A new token is free. A standing, possibly-exposed one is not worth keeping around.">
  Find your tokens: <code>Dev Dashboard → Partner Dashboard → Settings (☰) → Partner API clients</code>. Review every token, generate a fresh one where you still need access, update it in Shoffi, then revoke the old one.
</Callout>

**The precise steps Shoffi is recommending:**

1. In your **Shopify Partner Dashboard**, generate a **new** Partner API token.
2. In Shoffi, go to **My Apps → Edit App → Edit Token** and save the new token.
3. Once the new token is confirmed working, **revoke the previous token** from your Partner account.
4. While you're in there, audit *every* Partner API client — delete any you don't recognize or no longer use.

**Then reduce the next blast radius:**

- Grant Partner API clients the **minimum scopes** they need. If a service only reads financials, it doesn't need `manage_apps`.
- Keep an inventory of **which third parties hold which tokens**, so the next "rotate everything" takes minutes, not archaeology.
- The Admin API is unaffected here — but the same discipline (rotate on exposure, least privilege) is what keeps *that* surface clean too.

## Straight from Shopify

- [Partner API reference](https://shopify.dev/docs/api/partner) — what the Partner API exposes and the access scopes (`manage_apps`, `view_financials`, and more) that gate it; note it's org-scoped and separate from the Admin API.
- [Shopify API access scopes](https://shopify.dev/docs/api/usage/access-scopes) — the scope model in general; grant the minimum a client needs.
- [About client credentials](https://shopify.dev/docs/apps/build/authentication-authorization/client-secrets) — why credentials must stay secret, and the principle of rotating them on any suspected exposure.
- [Rotate or revoke client credentials](https://shopify.dev/docs/apps/build/authentication-authorization/client-secrets/rotate-revoke-client-credentials) — the mechanics of rolling a credential without downtime.