Customer Account sign-in fails: numeric sub in ID token payload

Shopify App Store
1

I’m integrating customer sign-in using a Dev Dashboard development store. The callback fails after Sign in with Shop and the emailed six-digit code.

Setup:

  • New customer accounts
  • Headless confidential Customer Account client
  • Permissions: customer_read_customers and customer_read_orders
  • Registered HTTPS callback
  • Node.js 24.19.0
  • openid-client 6.8.8; oauth4webapi 3.8.8

Diagnostics:

  • OAUTH_INVALID_RESPONSE
  • claim: sub
  • claimIssue: type
  • subJsonType: number

A type-only diagnostic of one decoded ID token payload showed sub was a JSON number. Signature validation had not completed, so this is an observation of the unverified payload. Earlier failures had less-specific diagnostics; I haven’t established whether it happens consistently.

The installed library uses plain JSON.parse without a reviver or type coercion and rejects a non-string sub. My application passes the token response through unchanged.

I haven’t weakened signature, issuer, audience, nonce or expiry validation, or added a string-casting workaround. No raw tokens, secrets or customer identifiers were retained in the diagnostic or shared.

Is this a known issue with Sign in with Shop and confidential Customer Account clients? What is the supported fix? If engineering investigation is needed, which non-sensitive diagnostics should I provide, and through what channel?

2

Hi @Eelya_V, thanks for reporting this and for providing such detailed information.

You’ve provided everything we need for now, and we’re investigating the issue.

In the meantime, could you check whether manually verifying the ID token would be feasible without weakening any existing security checks?