Shopify store backups
Keep a Shopify store's products, customers, orders, content and themes in your own storage, and put back what you choose.
A Shopify store job backs up one store through Shopify's Admin API, on a schedule, into your own storage: an S3-compatible bucket, Google Drive, Dropbox, Box or OneDrive. Run one before you, an agency, a freelancer or a new app changes anything, so a bad theme edit, bulk import or app install can be undone. Shopify store backups are on the Starter plan and up.
Connecting a store
Until Shopify approves VPS Snaps' own app, there is no one-click Connect with Shopify. A store connects through an app its organization makes in Shopify's Dev Dashboard. You give VPS Snaps the app's Client ID and Client secret, and VPS Snaps asks Shopify for a fresh 24-hour token for each backup. Start from Providers → Add provider → Shopify store, which shows the scopes and the redirect URL to copy.
- Open the Dev Dashboard (dev.shopify.com) with an account in the store's organization, then Apps → Create app → Start from Dev Dashboard. Name it VPS Snaps and click Create.
- On the app's Versions page, set Scopes to the list shown on the connect page, add https://vpssnaps.com/api/oauth/shopify/callback to the app's redirect URLs, and click Release.
- Click Install app and choose the store.
- In App settings, copy the Client ID and Client secret from the Credentials card, and paste them into the connect page with the store's myshopify.com address.
The read_ scopes are what a backup reads. The write_ scopes are only used when you start a restore, and you can leave them out until then: add them in a new released version when you need one.
A client's store
Shopify only gives tokens directly to an app in the store's own organization. For a client's store, make the app in your own organization, choose custom distribution for the client's store, and have the client install it from the install link. Then connect it with the same Client ID and secret: VPS Snaps sends you to the store to approve the app once, and backs it up from then on. Or the store owner can make the app in their own organization and send you the credentials.
A custom app made before 2026
A custom app made in the store admin before January 1, 2026 keeps its Admin API access token, which starts shpat_. Shopify shows it under Settings → Apps → Develop apps, on that app's API credentials. Give the app the scopes on the connect page and choose "An Admin API token from before 2026" there.
Customer data
Names, emails, phone numbers and addresses of the store's customers are protected customer data in Shopify. If Shopify asks, turn on access to it for the app. Without it, customers and orders are backed up without those details, and the run says so.
What a backup holds
Each backup is one .tar.gz file in your storage. It opens with tar xzf on any machine.
- Products, with their variants, images and metafields, and collections.
- Customers, orders and draft orders.
- Pages, blogs and blog posts, navigation menus, URL redirects and metaobjects.
- Files from Content → Files.
- Inventory levels, locations, discounts and markets.
- Store settings and policies.
- Every theme's files, published or not.
Images and files
"Include images and files" is on for each new job. With it on, the image, video and file bytes are copied into the backup, not just their links, so an image deleted from Shopify can be put back. With it off, the backup keeps only the links and stays small.
Box and OneDrive hold an archive in memory before it is uploaded, so there a backup must stay under 64 MB. A store with many images may need the switch off, or another storage destination.
Restoring
Open a successful backup and choose what to put back: a theme, products (all of them, or only the handles you list), collections, pages, blogs, menus, redirects, metaobjects, and customers missing from the store. Preview changes lists every difference between the backup and the store now, and changes nothing; anyone in the workspace can run one. Restore, which owners and admins can do after typing the store's address, first stores a safety copy of the store as a backup of the job, then writes only what differs.
- A theme never replaces the live one. Shopify lets an app write themes only once Shopify has granted it a theme exemption, which an app you make in the Dev Dashboard does not have: so on the backup's page, choose the theme and click Download theme as .zip, then upload it in Online Store → Themes → Add theme → Upload zip file, preview it and publish it when it is right. Where the app does have theme access, the restore writes the theme straight in as a new unpublished copy beside the live one.
- Nothing in the store is deleted, except inside a product you restore, which comes back exactly as it was backed up.
- Existing customers are never changed. Only customers missing from the store are added back.
- If Shopify refuses a record, the rest carry on, and the restore names each refusal and the safety copy that puts the store back.
What can't come back
- Orders, draft orders, inventory levels, discounts and markets are kept as records only. Shopify does not let any app write an order back into a store.
- Gift cards issued to customers are not restored.
- Customer passwords are never in a backup or a restore, because Shopify does not allow it. A restored customer signs in again.
- A metaobject whose type belongs to another app is skipped: only that app can create it.
Where the data goes
A store has no server of yours to run anything on, so our worker reads it through Shopify's Admin API and streams the archive straight on to your storage, in memory only, never keeping it. A restore reads the backup from your storage the same way. The Client secret or token is stored encrypted. Removing the connection, or uninstalling the app in Shopify, ends VPS Snaps' access.