Customer API Authentication

Hydrogen and Storefront APIs
1

In the customer authentication api docs[1] the {shop_id} which refers to the id portion of the gid from graphql query { shop { id } } is used to generate the api url e.g. https://shopify.com/{shop_id}/account/customer/api/graphql.json

While the admin & Storefront API use {shop}.myshopify.com (e.g. https://{shop}/admin/api/graphql.json) as the identifier.

This complicates token management as there is no way to deduce the {shop_id} from either the jwt token, e.g.

{
  iss: 'https://{store}.myshopify.com/checkouts',
  dest: '{store}.myshopify.com',
  aud: {client_id},
  exp: {expires},
  nbf: {not_before},
  iat: {issued_at},
  jti: {id|nonce},
  sub: 'gid://shopify/Customer/{customer_id}'
}

nor request url or headers. In the admin / Storefront API you use the jwt.dest, my proposal would be to change the dest return the shop_id instead of the myshopify domain.

My current workaround is to store the shop_id during the authentication process, and query the session on the jwt.dest, but use the session.shop_id to generate the api url.

2

Hey @chr33s :waving_hand: , hopefully I’m understanding correctly, but you’re just looking at retrieving the shop ID from within the Admin/Storefront API for an integration within a Headless/Hydrogen shop? If so, you should be able to grab that like this if your app has an Admin/Storefront API component:

{
  shop {
    id
  }
}

If you integration is already authorized via OAuth to use either the Admin/Storefront APIs on the shop, that query should return a GID like: gid://shopify/Shop/1234567890. You could then parse the trailing number as the {shop_id} for Customer Account API endpoints and map things that way.

Let me know if this doesn’t work for your use case and I’d be happy to look into this further with you for sure though!

3

@Alan_G thanks for the reply, I appreciate it.

My comment was about having to perform a request to get the ID creates a latency, when the other api’s don’t as you can get the shop from request.

The use case is we offer our clients a unified stack to build on Shopify (admin, storefront proxy/headless, and customer accounts / extensions). Managing the online tokens in a background process.

Following Customer Account API reference, when receiving a request on the server we verify and decode the token, but with the provided information (jwt token, request header and url search params) there is no obvious way to recreate the api url (https://shopify.com/<shop_id>/account/customer/api/unstable/graphql) due to the missing shop_id.

There are workarounds, but IMHO it’s less than optimal as if e.g. jwt dest was shopify.com/<shop_id> there would be no need for work arounds.

The admin & Storefront API urls e.g. are https://{shop}/admin/api/unstable/graphql.json

An alternative to the jwt.dest could be jwt.iss which is currently set to https://{shop}.myshopify.com/checkouts

4

Thanks @chr33s, appreciate your clarifications here. I’ll reach out to our product team for you to see if enabling this is on our roadmap since I definitely see this as valid usecase/piece of feedback for sure.

I can’t guarantee anything on my end, but I’ll loop back with you here once I have more info to share, even if it’s just passing along an official feature request for you. Speak soon!

6

Hey again @chr33s, I was able to touch base with one of my colleagues on this for you and just wanted to confirm that like you mentioned we don’t have an “official” way of retrieving the Customer Account API URL, but I was able to forward your feedback to our product folks who have let me know that it is on our radar to improve how this works in the future and enable a documented way of retrieving the URL.

I can’t share a timeline on this or what it will look like, but it is something we are working on at the moment. Hope this helps!

7

@Alan_G much appreciated.

1 Like