301 error from oauth token route - customer account API

Authentication & Access
1

We’re using this route: https://shopify.com/authentication/{store_id}/oauth/token to fetch tokens via the Headless app, as per this documentation. This worked fine for the last ~year, but suddenly this morning at 10AM this endpoint started returning 301 permanent redirects for every request. Nothing has changed on our end, and I’ve double checked that our tokens are still active and the store ID hasn’t somehow changed.

Anyone else experiencing anything similar? This is currently breaking our custom account portal for all logged in customers.

2

Hey @Sean_Denny :waving_hand: - would you happen to have any X-Request-ID values available from the Response Header for examples of where you’re seeing the 301 responses?

I can definitely take a look at our logs to investigate further for you.

3

@Alan_G I don’t have an X-Request-ID, I’m guessing because this is being caught by Cloudflare. Here are the headers I do have (with our store ID scrubbed), do these help?

Request to: “https://shopify.com/authentication/${scrubbed_store_id}/oauth/token”
With body:
{“client_id”=>“scrubbed_client_id”,
“grant_type”=>“authorization_code”,
“code”=> “scrubbed_access_code”,
“redirect_uri”=>“scrubbed_redirect_url”}

Response: <html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>cloudflare</center>\r\n</body>\r\n</html>\r\n

Headers:
{“date”=>[“Thu, 05 Jun 2025 17:37:47 GMT”],
“content-type”=>[“text/html”],
“content-length”=>[“167”],
“connection”=>[“close”],
“cache-control”=>[“max-age=3600”],
“expires”=>[“Thu, 05 Jun 2025 18:37:47 GMT”],
“location”=>[“https://shopify.com/authentication/${scrubbed_store_id}/oauth/token”],
“report-to”=>
[“{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BJsyuNVWGXt8feSD1qjFrWJpvax9CmqsREqv1C5ZT7SpSKVeA9VtGqjniwS2vtbUAnGxkb5a82%2FgdHJY%2BwMFkX0NmDPVafg1%2FdmQwESvTihBixDbcqxKSWIjIzcJ"}],"group":"cf-nel","max_age":604800}”],
“nel”=>[“{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}”],
“vary”=>[“Accept-Encoding”],
“server-timing”=>[“cfRequestDuration;dur=12.000084”],
“x-xss-protection”=>[“1; mode=block”],
“x-content-type-options”=>[“nosniff”],
“x-permitted-cross-domain-policies”=>[“none”],
“x-download-options”=>[“noopen”],
“shopify-edge-ip”=>[“23.227.38.33”],
“server”=>[“cloudflare”],
“cf-ray”=>[“94b170a23e0c42b2-EWR”],
“alt-svc”=>[“h3=":443"; ma=86400”]}

4

Hey @Sean_Denny :waving_hand: - thanks for sending that my way. I was just doing some digging, and I think one of my colleagues and I were helping out your Merchant Success Manager behind the scenes with this a bit as well.

Did you end up resolving this by enforcing HTTPS on the token fetch route by any chance?

Just wanted to mention that here in case anyone else runs into the issue and stumbles across this thread on the future. :slight_smile:

5

Yes, we were previously using the HTTP route, and I’m guessing there was a change on Tuesday that enforced HTTPS for this route. Switching over to HTTPS was the solution.

1 Like