Shopify Sidekick in Production: Engineering Review (2026)

Shopify Sidekick operates as an approval-first orchestrator inside the merchant admin rather than an autonomous storefront agent. While it accelerates reporting and discount generation, it cannot edit Liquid themes directly or execute unapproved API mutations. For engineering teams, its real leverage lies in Sidekick App Extensions and downstream Shopify Flow automations.

The Sidekick architecture and approval boundary

Sidekick functions as a conversational interface layered over the Shopify GraphQL Admin API, extracting metadata from the current admin page context. When you inspect an order or open a product record, the assistant passes those entity identifiers into its prompt pipeline to generate actionable suggestions.

The critical engineering characteristic of this architecture is its mandatory approval boundary. Unlike headless AI agents that execute autonomous write operations against database records, Sidekick drafts mutations for human verification. If you instruct it to apply a storewide discount or alter customer tags, it renders a confirmation drawer showing the exact field diffs before committing the change.

Staff permissions enforce this boundary at the platform level. Sidekick does not run with elevated system privileges; it inherits the authenticated session scopes of the active user. If a junior support operator lacks permission to export customer lists or edit inventory quantities, the assistant will refuse those instructions. In our experience auditing client workflows, this permission inheritance prevents accidental data exposure, but it also means Sidekick cannot act as a background superuser for complex multi-system reconciliations.

To understand where Sidekick sits relative to other automation and customisation tools in the ecosystem, the comparison table below outlines the core differences in execution model, cost, and developer extensibility.

How we evaluate admin automation tools

When we scope automation for a client store, we place each of the four layers above against five technical criteria: execution latency, developer extensibility, mutation safety (permission boundaries and rollback mechanisms), infrastructure cost, and blast radius during failure states. The same criteria drive the comparisons in this review.

In the builds we see, the pattern is consistent: staging a change through Sidekick and approving it is typically faster than manual admin navigation for ad-hoc work, while anything recurring belongs in Shopify Flow workflows from day one. App-extension tool calls authenticate with the active admin session and fetch from your app backend, so the practical constraints are your endpoint latency and payload discipline, not the assistant itself.

Our recommendations prioritise operational predictability. When an operation requires deterministic, zero-touch execution or tight execution budgets at checkout, native Shopify Functions and Flow beat a conversational assistant every time. Sidekick earns its place for ad-hoc analytical queries and low-risk draft mutations where human verification is already standard practice.

Is Shopify Sidekick free for every merchant plan?

Yes, Sidekick is included without a standalone add-on subscription across standard Shopify plans, including Basic, Shopify, Advanced, and Shopify Plus. You do not pay per token or buy API credits to run administrative queries, draft product summaries, or generate standard reporting visualisations.

However, feature gating applies as you move up the tier stack: Shopify documents that some Sidekick capabilities, such as generating custom admin apps from conversational prompts, are limited to higher tiers, and usage ceilings are reported to apply to the heavier generation features. On standard Shopify Plus contracts (which typically cost around £1,800 to £2,500 monthly depending on revenue volume), enterprise merchants receive expanded concurrency allowances and dedicated support channels for platform AI features.

The zero-marginal-cost model makes Sidekick practical for day-to-day administrative lookups, but teams should avoid assuming external AI integrations carry the same pricing structure. Custom agentic pipelines built with private LLM endpoints will incur separate per-token inference charges, whereas native Sidekick interactions remain bundled into your recurring platform subscription.

What LLM does Shopify Sidekick use under the hood?

Shopify powers Sidekick through its proprietary Shopify Magic routing infrastructure, which directs incoming user prompts across multiple foundation models rather than relying on a single static LLM. Shopify has publicly described using a mix of commercial foundation models and specialised internal models trained on commerce data; it does not publish a stable model list, and the mix changes without notice.

The routing layer selects the underlying engine based on the computational complexity of the task: routine administrative lookups and copy formatting route to lighter, low-latency models, while complex analytical queries, cohort filtering, and GraphQL mutation scaffolding route to larger reasoning models. Which vendor serves which tier is not documented, so treat any specific model claim you read elsewhere as unverified.

From a data security perspective, merchant queries execute within Shopify's managed tenancy. Operational store data, customer records, and financial figures are not passed into public training pools. Because the routing abstraction is fully managed, merchants cannot configure custom temperature settings or swap out model checkpoints, which keeps operational overhead low but eliminates low-level prompt engineering controls.

The reality of Shopify Sidekick API and MCP access

Shopify does not provide a public REST or GraphQL API endpoint that allows external microservices to invoke Sidekick conversations directly. Merchants searching for a direct Sidekick API are often looking to pipe external ERP triggers into the assistant, but Sidekick is strictly designed as an inbound merchant-facing interface rather than an addressable external service.

Developer extensibility operates in the opposite direction through Sidekick app extensions. Using the Shopify CLI, developers register app tools and data extensions (admin.app.tools.data) that allow Sidekick to query third-party app databases. When a merchant asks Sidekick a relevant question, such as finding top-performing loyalty cohorts, Sidekick executes client-side tool calls in the merchant's browser using standard browser Fetch API specifications to pull data from your app backend.

Developers exploring Sidekick MCP configurations need to differentiate between the admin assistant and Shopify's broader Model Context Protocol integrations. While Sidekick consumes app extensions internally, Shopify exposes separate developer-facing MCP endpoints, including the shopify.dev MCP server for IDE code generation and the Storefront MCP server at https://{shop}.myshopify.com/api/mcp for agentic customer shopping flows. For a comprehensive walkthrough of configuring these endpoints, see our guide on Shopify MCP server implementation.

Where Sidekick fails and when to use Flow instead

Sidekick fails when your commerce operations require autonomous background execution, programmatic event triggers, or direct theme code manipulation. Because the assistant requires an interactive user prompt and a manual confirmation click, it cannot handle recurring, headless business logic.

If you need automated customer tagging, inventory threshold alerts, or downstream ERP synchronization, Shopify Flow is the correct architecture. Flow operates on event-driven webhooks and can be triggered programmatically from external systems via the flowTriggerReceive GraphQL mutation. While Sidekick can help you draft a Flow workflow from plain English, the resulting automation executes independently inside Flow's deterministic runtime. For production workflow architectures, review our analysis of Shopify Flow AI agent automation patterns.

Similarly, Sidekick cannot modify your storefront's Liquid templates, section schemas, or frontend CSS files. Asking the assistant to redesign a product page or inject custom variant selectors will result in a hard refusal. For checkout logic, discounts, and delivery validations, teams must use Shopify Functions, which execute compiled WebAssembly binaries within a strict budget of 11 million instructions per invocation. Treating a conversational chat prompt as your primary inventory sync mechanism is the operational equivalent of using a walkie-talkie to run database replication: it works until someone forgets to push to talk.

Engineering decision rules for Sidekick in production

When evaluating Sidekick for enterprise operations, technical leads should apply three strict decision rules to avoid architectural technical debt.

First, treat Sidekick as an accelerator for human operators, not as backend infrastructure. It excels at generating complex customer segments, summarising multi-channel sales trends, and staging promotional discounts. If an operational task requires manual verification anyway, routing it through Sidekick saves time. If the task must run 500 times a day across automated order events, move it to Shopify Flow immediately.

Second, establish guardrails around custom app generation. While Sidekick can scaffold basic admin apps using Polaris components, these generated apps lack production logging, automated test coverage, and enterprise error handling. In our work with Plus merchants, we treat generated apps as functional prototypes to be refactored into structured codebases before deploying to live production stores.

Third, leverage Sidekick App Extensions if you maintain custom private apps or App Store integrations. Exposing read tools and action links to Sidekick allows your merchandising team to query your custom systems without leaving the core admin interface. If your team needs structured architectural support to build custom apps or integrate complex ERP endpoints, explore our Shopify development services.

What to do next with your Shopify AI architecture

Start by auditing the administrative permissions across your store staff. Because Sidekick inherits user session privileges, tightening Admin API access scopes ensures that staff members cannot accidentally stage unauthorized price changes or export sensitive customer records through conversational prompts.

Next, review your repetitive manual tasks across merchandising and support. Identify workflows that are purely administrative (such as drafting seasonal collection copy or reviewing discount usage) and establish structured Sidekick prompt templates for your team, noting the admin limit of 25 saved custom skills per account.

Finally, separate your conversational workflows from your programmatic integrations. Migrate critical operational triggers to Shopify Flow webhooks, compile checkout rules into native Shopify Functions, and keep your primary data pipelines deterministic. Conversational AI accelerates administrative discovery, but deterministic code keeps enterprise commerce reliable.