A practical setup guide for a Shopify AI agent that answers product questions for anyone and order questions only after verification.
Here's a test worth running on any store chatbot. Open the chat, type an order number that isn't yours, and ask where it is. If the bot tells you the delivery address or the items, it has just handed a stranger someone else's order.
Shopify takes this seriously for the apps on its own platform. Its protected customer data requirements tell developers to "process only the minimum personal data required to provide app functionality to merchants". Name, address, email and phone fields need separate access requests, because they directly identify customers. Your Shopify AI chatbot should meet the same standard in the conversation itself.
I build AI chat agents for a living, so I have a stake in this. This post is the practical setup guide. If you want the why first, including what order questions cost a store, read Where's my order: the most expensive question your store answers.
A scenario: one store, two kinds of customer
Picture a hypothetical Shopify store that sells espresso machines and grinders. Most orders come from home baristas. A growing share come from small cafés ordering several units at a time.
Both groups ask the same two kinds of questions. "Which grinder works with this machine?" and "Where's my order?" The first is safe to answer for anyone. The second should only be answered for the person who placed the order.
Behind the scenes, the support team has its own questions. "Find the café order from last Tuesday. Has it shipped?" They shouldn't need to open the Shopify admin for every one.
How we handle it: two assistants, one read-only connection
Our Shopify integration connects your store to two separate assistants. A customer assistant sits in your website chat. It answers product questions, and order questions only after the customer verifies. A staff assistant runs in a private chat for team members you choose.
The connection is read-only. It can't modify orders, issue refunds, cancel purchases or change stock. Each AtomicX account connects to one Shopify store.
Before you start
- You need the Owner or Admin role in AtomicX.
- The Shopify app and its sign-in return addresses must be configured by an administrator first. App secrets are never entered in chat.
- If you want guest order checks, email delivery must be set up, because they send a code by email.
- If you want customers to sign in with their Shopify account, you need a Shopify Customer Account API client ID for your store.
1. Connect the store
Go to Integrations → Integrations and open the Shopify card. Under Store connection, enter your store hostname, such as your .myshopify.com address. Click Connect Shopify and finish authorization in Shopify.
2. Test what actually works
Click Test connection and check the Products, Orders and Older orders capabilities. This step matters. A saved connection doesn't guarantee every capability works. If one shows Not available, fix it before you rely on it. Older orders may need extra access from your administrator.
3. Turn on customer sign-in (optional)
Enter the Shopify customer account client ID, click Configure customer login, and confirm that Customer login shows Available.
4. Create, review and publish both agents
Under Two separate assistants, click Create or open agent drafts. Review and edit both the customer and staff agents, then publish them under AI → AI agents. Running the draft setup again keeps your existing edits.
5. Put the customer agent on your website chat
Assign the customer agent to your public chat, including any AI Chat node in a workflow. The staff agent stays private. It can't be placed on a public widget at all.
6. Show products as cards (optional)
If you want matching products to appear as cards with a photo, price and link, edit the agent and select List products under Skills. Shopify stores can use live product, variant, price and availability data from the integration. Cards show up to 10 products in a swipeable carousel. (Guide)
7. Choose who sees store-wide orders
Under Staff access, tick each team member who should be able to look up orders across the store. Being an Owner or Admin isn't enough on its own. They need the tick too.
What the customer sees
When a shopper asks about an order, they click Verify order access below the chat. That opens a separate window with two routes, explained in our verification guide.
- Sign in with Shopify. The customer signs in and can ask about their own orders, up to ten recent ones.
- Guest order code. The customer enters the Order number and Order email address, then clicks Send verification code. If the details match, an eight-digit code arrives by email. They enter it and click Verify this order.
The window doesn't confirm whether the details matched an order, so it doesn't tell a stranger which order numbers are real. Codes expire after 10 minutes and allow five attempts. Guest access covers that one order for 30 minutes.
Once verified, the customer can ask about order status, payment and fulfillment status, and tracking. They can click Clear order access when they're done.
What your team sees
Enabled team members open the Shopify staff chat while signed in to AtomicX. They type a question under Ask about products or orders, such as "Find order #1001 and show its fulfillment status." They can search by order number or email address.
For our espresso store, that's the café order from last Tuesday, answered without opening the admin.
Test before you go live
- Ask the website chat about a product you sell.
- Run Verify order access with a real test order, once by sign-in (if you set it up) and once with an emailed guest code.
- Ask about the same order in the staff chat as an enabled team member.
- Try the test from the top of this post. Ask about an order without verifying, and check that the agent doesn't reveal it.
The limits, honestly
- Tracking only appears when Shopify has it. The assistant can't create tracking numbers or mark orders as shipped. Payment and fulfillment are tracked separately, so a paid order may not have shipped yet.
- Products must be published. Product results include only items published to the online store.
- Prices are "From" amounts in store currency. Specific variants may cost more, and the prices don't reflect localized checkout pricing.
- Staff chat isn't saved. The private session clears when you leave the page, and it doesn't appear in Chat → Conversations. Copy any notes you need first.
- Refunds and changes stay with people. That's by design. The AI can't make them, and the chat can hand off to your team when a case needs a human.
- Switching stores resets access. If you click Disconnect, existing customer order access is cleared and customers must verify again.
The bigger pattern
A store chatbot has two very different jobs. Answering product questions is about being helpful to anyone. Answering order questions is about being careful with one specific person's data. Mixing them up is where things go wrong.
Keeping the two apart, with verification in the middle and read-only access underneath, is what lets you leave the agent running overnight with a clear idea of what it can and can't do. Want to see it with your own store? Book a 20-minute demo, or read the Shopify setup guide first.