Developers and agencies
Agent tokens
Create, use and revoke the tokens that let psx or an AI agent on your own computer work on your store.
An agent token lets the psx command-line tool — or an AI agent using it — work on your store from your own computer. The agent can do what you can do in the PageStax admin: read and edit pages, create offers, and (when told to confirm) publish.
Create a token#
- Open PageStax inside your Shopify admin and go to Settings → Integrations.
- In the Agent access card, enter a Label that says where the token will live (for example "My laptop").
- Press Create token.
- Press Copy token. The token is shown this once — PageStax keeps only a fingerprint of it.
- The card also shows the command to run under Then run. With the token on your clipboard, run it in a terminal:
pbpaste | psx login --shop your-store.myshopify.com --url https://app.pagestax.com
psx login --check
psx login --check makes one quick read and tells you whether the token was accepted.
- Press Done.
Reading the token from the clipboard (or the PSX_TOKEN environment variable) keeps it out of your shell history. psx stores it in ~/.config/pagestax/psx.json, readable only by you and outside your code.
Revoke a token#
In Settings → Integrations, the Agent tokens card lists every token with its Label, when it was Created and when it was Last used. Press Revoke and confirm with Revoke token. The token stops working on its next request (copies can take up to a minute to clear everywhere).
How tokens are kept safe#
- A token works only for the store it was created in, and only when the request names that store.
- A token can't create, list or revoke tokens — only the Settings screen can.
- PageStax never logs a token or shows it again after the first reveal.
- At most 5 tokens can be created in an hour, and 20 can be live at once.
- Uninstalling PageStax deletes every token for the store.
Shopper-visible actions need confirmation#
Publishing, unpublishing, taking an offer or journey live, starting a test and pushing live all require an explicit --confirm in psx. An agent should ask you before it adds it. See The psx CLI quick start.