BIK vs Shopify Sidekick (2026)

The native Shopify integration ties two way conversational messaging to store events, draws AI product recommendations from the connected catalog and takes order actions through an AI Order Management module. Beyond Shopify, BIK says any app can be connected and calls itself an open API platform using webhooks and REST API blocks. Its REST endpoints create and update customer profiles, sync the product catalog, ingest events and trigger flows, and webhooks send real time notifications back out.

Sourcedocs.bik.airead 2026-09-05

The app ecosystem is the integration layer, instead of a list of connectors. Sidekick works natively across the whole Shopify surface, on every screen of the admin, in the mobile app and on Apple Watch. Sidekick App Extensions take it into third party apps in two forms. Data extensions surface a partner app's data when a merchant asks a relevant question, and action extensions route the merchant to the right place inside an app and stage the change.

Named launch partners include Klaviyo, Loop, Smile, Judge.me, Matrixify, Avia, Seguno, Checkout Links and Yotpo, spanning email, loyalty, reviews, data operations and conversion. Underneath sits the full Shopify Admin and Storefront API surface, and Sidekick can build Shopify Flow automations from a plain language description. The tool surface grows as partners build for it, not as Shopify writes integrations.

Sourceshopify.dev Sidekick documentation and Spring 26 Edition developer announcementread 2026-09-02

Journey and campaign builders cover revenue flows including abandoned cart recovery, order confirmation, welcome, upsell and cross-sell. A Flows API triggers automated journeys programmatically, and an Events API ingests customer events to build the cohorts those journeys act on.

In Agent Studio, a brand defines an agent's goal, success criteria and instructions, so the agent works toward an objective instead of following a fixed script. Work moves between surfaces, with AI Classify routing on intent and handing off into the shared inbox when a person is needed. A drip module sequences follow up over time.

Sourcedocs.bik.airead 2026-09-05

Inside the admin, Sidekick carries out what a merchant asks for in natural language instead of describing how. It creates discount codes, modifies themes, generates product copy and images, creates customers, edits store policies, surfaces underperforming products and builds Shopify Flow automations from a description. It can also generate whole applications from a prompt and multitask in the background, and Sidekick Pulse monitors store data to surface anomalies unprompted.

Work starts with the merchant in conversation, not from a trigger. In third party apps the pattern is stage and confirm. Sidekick routes merchants to the right spot inside an app and stages changes for confirmation, and the merchant acts. A release announcement says AI agents now handle entire workflows end to end, but no path runs unattended from trigger to completion.

Sourceshopify.dev Sidekick documentation, Winter and Spring 26 Edition announcementsread 2026-09-02

Work runs over six channels and starts in three ways. The channels are WhatsApp, Instagram, a website chatbot, Facebook Messenger, SMS and email, and the Messages API delivers WhatsApp, email and SMS directly. Work starts inbound through the helpdesk and chatbot.

It also starts from events, as the Events API ingests customer events and store activity that fire journeys such as abandoned cart, back in stock and price drop. On social, Instagram comment-to-DM turns a public comment into a private conversation. Outbound campaigns and AI drip sequences let the agent start conversations, not only receive them. The Flows API lets an external system start a journey on its own schedule.

Sourcedocs.bik.airead 2026-09-05

Sidekick Pulse monitors store data in the background and surfaces opportunities and anomalies, such as a conversion drop or an underperforming product, before the merchant asks. Inventory alerts and discount optimization prompts arrive the same way.

Merchants can also reach Sidekick on every screen of the Shopify admin, throughout the mobile app, which has voice chat, and from Apple Watch, and it can multitask in the background. It serves the merchant, not the shopper. The shopper facing surfaces in Shopify's stack (Agentic Storefronts, Store AI, the Universal Commerce Protocol) are separate products. Shopify does not say exactly what Pulse watches or how often it checks.

Sourceshopify.com/sidekick and Shopify Spring 26 Editionread 2026-10-01

Agents draw on the connected Shopify catalog. AI Product Recommendation works off that integration, so suggestions match what the store actually sells, and the Products API keeps the catalog synced as a maintained source. Agents are configured with instructions and brand context so responses stay on brand, and AI Classify interprets intent against that setup. There is no document knowledge base, help center ingestion, retrieval architecture, refresh behavior or source citation. Grounding is structured commerce data, and support agents have no knowledge layer to answer policy questions from.

Sourcebik.airead 2026-09-05

Sidekick grounds its answers in the merchant's whole commerce system of record, natively, with no integration step and no sync lag. Catalog, inventory, orders, customers, policies and historical performance are queried live instead of indexed, and Sidekick can run ShopifyQL against real orders and analytics. Data extensions add retrieval across apps.

One merchant question makes Sidekick query several installed third party apps at once, rank the results, combine them with store context and return one answer with branded cards, so email, loyalty, review and analytics data from separate vendors arrive as a single grounded response. Retrieval respects each staff member's permissions, so the answer covers only what that person may see.

Sourceshopify.dev Sidekick documentation and Winter 26 Edition developer announcementread 2026-09-02

An Agentic CDP module is one of BIK's named capability areas. A Customers API creates and updates profiles, and an Events API ingests behavioral events to build cohorts and segments. A persistent unified profile follows the customer across WhatsApp, Instagram, SMS and email with conversation history attached. The CDP is a database the brand loads, segments and queries. There is no agent memory product and no scope, lifetime or deletion control for retained agent state. BIK does not say what an agent itself carries between separate conversations.

Sourcedocs.bik.airead 2026-09-05

Store data that Shopify holds permanently backs Sidekick, and Shopify calls it extensive knowledge of the merchant and their store. Conversation history is kept and can be opened again, and background multitasking keeps task state within a session. Nothing carries between conversations that a merchant can rely on. Sidekick learns no merchant preferences, keeps no state per agent and gives the merchant no control over retention or forgetting. Merchants cannot fine tune a model on their catalog or customer data.

Sourceshopify.com/sidekick and shopify.dev documentationread 2026-10-01

Humans and agents share a workspace. In the multi channel CRM and AI Helpdesk, human and AI agents work the same inbox across WhatsApp, Instagram, Messenger, SMS and email. AI Reply drafts responses, AI Assistant and AI Summary support the human, and AI Classify routes by intent so a case reaches the right resolution path.

There is no guardrail configuration, content policy, approval step, autonomy ceiling or set escalation rule. A person can step in through the shared inbox, but nothing limits what the agent does before then. Spam limiters throttle outbound message volume for campaign deliverability.

Sourcebik.ai/multichannel-crmread 2026-09-05

Merchants approve changes as Sidekick works, and Shopify checks extensions before any merchant sees them. Changes are shown to the merchant for approval before they are applied, and action extensions stage changes for confirmation, so when Sidekick acts inside a third party app the merchant confirms the change instead of finding it later.

Sidekick respects each staff member's admin permissions, so a person can act only on what they were already authorized to touch. Before publication, Shopify enforces a content and safety policy over every Sidekick extension and scans against it automatically, blocking tools that fail from appearing to merchants. Partners are selected into the preview. Both checks are part of the extension contract, so they apply to every third party extension.

Sourceshopify.dev Sidekick documentation and shopify.com/sidekickread 2026-09-02

SOC 2, GDPR and ISO marks sit alongside a Meta Business Partner badge, under BIK's statement that customer data is its first priority. The company has a dedicated GDPR page, a privacy policy, terms and a master agreement. Nothing backs the certifications beyond the badges. There is no trust portal and no report to download or request. BIK states no ISO standard number or SOC 2 type and names no auditor. Customers get no controls either, with no SSO, role based access control, audit log or retention configuration.

Sourcebik.airead 2026-09-05

Shopify is certified Level 1 PCI DSS compliant and has been issued SOC 2 Type II and SOC 3 reports for the service it provides to customers. It publishes a subprocessor list and a data processing addendum, and data from EEA, UK and Swiss customers is initially processed by Shopify International Limited in Ireland. Sidekick respects each staff member's existing admin permissions, so people act only on data they are already authorized to see.

Every Sidekick app extension runs inside Shopify's sandbox under Shopify auth, with exactly the API scopes of its parent app, so a third party tool cannot exceed the permissions the merchant granted. Shopify runs an automated security scan on every preview and deploy, records the outcome as a Sidekick event and blocks failing extensions from reaching merchants.

Sourceshopify.com/security, shopify.dev Sidekick app extensions documentation and help.shopify.com privacy pagesread 2026-10-01

Reporting covers outcomes, not how each run executed. Advanced Analytics, one of BIK's named capability areas, covers campaign performance, real time growth insight and revenue attribution. BIK's headline claim rests on measurable ROI from those dashboards. Through the Events API, the brand can query the underlying activity stream. There is no reasoning trace per conversation, tool call log, session history view or configuration audit trail for an individual agent run. A customer can see what an agent achieved in aggregate but cannot reconstruct what it did in a given case or who changed it.

Sourcebik.airead 2026-09-05

Logs serve the developers who build extensions, not merchants. Extension builders get Sidekick events written to their app's logs in the Dev Dashboard, with the security scan outcome, the scan target and the time it ran, so they can see whether an extension integrated or was blocked.

Merchants get no audit log of what Sidekick did on their behalf, no record of which extension or data source answered a question, and no way to tell an admin change made by the agent from one made by the user. There is no retention policy over conversations. Builders cannot see Sidekick's UI during development, so Shopify points them to comprehensive logging as their best debugging tool.

Sourceshopify.dev Sidekick documentation and Shopify developer education materialread 2026-09-02

There is no stated hosting region, data center location, residency option or self hosted deployment. BIK's legal documents are a privacy policy, a dedicated GDPR page, terms and a master agreement. Delivery is cloud only SaaS, installed either directly or through the Shopify App Store, with no self hosted or private cloud option. BIK repeatedly says the brand owns its data, which is about rights, not about where the data sits.

Sourcebik.ai/gdprread 2026-09-05

Shopify moves data between regions as part of how it operates. It dynamically rebalances storage between multiple Google Cloud Platform regions to keep its infrastructure reliable and scalable across its merchant database, and it needs to move data geographically to run its services, with mechanisms in place to do so lawfully. Even where merchant customer personal data is stored in Europe, Shopify relies on international transfers to process it.

Personal data from EEA, UK and Swiss customers is initially processed by Shopify International Limited in Ireland, and group and subprocessor DPAs carry protections for Canada, the United States and Singapore. Customers cannot choose a region. There is no on premises, private VPC or single tenant option and no residency commitment for Sidekick or the platform beneath it, and Shopify Plus has no residency option either.

Sourcehelp.shopify.com international data transfers and subprocessors pagesread 2026-09-02

BIK offers more than 100 prebuilt AI commerce agents across retention, acquisition and support. A brand can choose one of them or build an agent of its own by giving it a goal, success criteria and instructions.

Agents span nine capability areas (agentic acquisition, agentic retention, AI order management, AI helpdesk, agentic gamification, agentic CDP, advanced analytics, Agent Studio and AI campaign), with prebuilt revenue flows and gamification modules alongside. More than 500 global brands use BIK, a figure that counts brands, not agents. The catalog of agents itself is not on public display.

Sourcebik.airead 2026-09-05

Merchants get one agent, not a catalog of agents. There is no library of named, purpose built agents for a merchant to browse, no marketplace of agent templates and no way to compose, clone or start a new agent. Sidekick's capabilities grow through the ecosystem instead. Sidekick App Extensions launched with more than fifteen named partners, each adding data and action tools, so Sidekick can do more without Shopify shipping new agents. Builders also get scaffolding templates through the Shopify CLI.

Sourceshopify.dev Sidekick documentation and Spring 26 Edition announcementread 2026-09-02

Customers configure an agent through its goal, success criteria and instructions, not through a choice of model. There is no model selection, routing configuration or way to bring your own key. The API at docs.bik.ai covers messaging, events, flows, customers and products and has no model parameter. BIK names no model provider.

Sourcebik.airead 2026-09-05

No model provider is named for Sidekick. Merchants get no model selection or routing and no way to bring their own model or key, and extension developers register tools but do not choose the model that calls them. Shopify manages the model as infrastructure on the merchant's behalf, inside a product bundled into its commerce platform and sold to merchants who are not technical, and it gives the merchant no lever over the model and no disclosure of it.

Sourceshopify.dev documentation and Shopify 2026 Edition announcementsread 2026-09-02

Public REST API documentation at docs.bik.ai has a getting started guide, an authentication section, a full API reference and a Postman collection, all reachable without a login. The API has six named groups. Messages delivers WhatsApp, email and SMS, Events ingests customer events to build cohorts, Flows triggers automated journeys, Customers creates and manages profiles, Products syncs the catalog, and Webhooks sends real time event notifications. BIK calls itself an open API platform connected through webhooks and REST API blocks. There is no client SDK or MCP server.

Sourcedocs.bik.airead 2026-09-05

Third party developers build for Sidekick through Sidekick App Extensions, set out at shopify.dev. Extensions are scaffolded through the Shopify CLI, declare their capabilities in tools.json and instructions.md, target modules, run a local round trip against the Sidekick preview and deploy atomically. Two extension types ship, data and action. The program launched with more than fifteen named partners and is open to any developer through Shopify Partners. Several MCP servers sit around it.

A Dev MCP server, distributed as an npm package, connects Claude Code, Cursor, Gemini CLI, Codex and VS Code to Shopify's documentation and API schemas, and there are Storefront, Catalog and Checkout MCP servers. Shopify co-developed the Universal Commerce Protocol with Google, and developers can register their own agent profile and call its public endpoint. Sidekick extensions work like MCP but are not MCP. An existing MCP server cannot be reused, because tools run in Shopify's sandbox under its auth, against a Shopify specific schema that is statically indexed.

Sourceshopify.dev/docs/apps/build/sidekick and Shopify developer announcementsread 2026-10-01

A target is set at build time and measured after launch, and nothing tests the agent in between. In Agent Studio the customer defines an agent's goal, success criteria and instructions, which set a standard to read performance against. Advanced Analytics reports outcomes once the agent is live.

On the delivery side, spam protection, rate limiters and reattempt logic optimize whether a message lands. There is no simulation, staging environment, test case, regression suite or scored pre release evaluation of a proposed agent, so nothing catches a bad agent before customers meet it. The deliverability modules act on message transmission, not on agent behavior.

Sourcebik.airead 2026-09-05

Extension builders can test before release, but merchants cannot. Builders run a local round trip of their app against the Sidekick preview, and hot reload reruns the security scan automatically on save, with pass or fail shown as Sidekick events. Deploys are atomic and reject an unsupported intent type outright instead of shipping it broken. Merchants get no sandbox to rehearse Sidekick against their own store, no evaluation of answer quality, no regression check when the catalog or an installed app changes, no scoring and no way to compare configurations.

Sourceshopify.dev Sidekick documentation and Shopify developer education materialread 2026-09-02

Agents act programmatically, through the native Shopify integration, REST endpoints for messages, customers, products, events and flows, and webhooks. They reach people over conversational channels instead of operating a screen. There is no browser control, hosted session, virtual desktop or interface automation. Instagram comment-to-DM and in-chat purchase run on platform APIs, not on an agent driving the Instagram interface.

Sourcebik.airead 2026-09-05

All of Sidekick's work happens in Shopify's own interface, through Shopify's own APIs. It navigates the Shopify admin, modifies themes, fills forms and generates applications, all inside Shopify's own product and through its programmatic surface. It does not control a browser or operate a screen, uses no robotic process automation and cannot act in software outside the Shopify surface.

Sourceshopify.dev Sidekick documentation and Shopify 2026 Edition announcementsread 2026-09-02