Encountering CORS on GraphQL Customer Account API from Customer Account Extensions

Extensions
1

Hello Everyone,

I am currently working on Customer Account Extensions where there is a third party Shopify App API that we are trying to integrate which requires us to supply the logged in customer account access token.

Now this lead me to using GraphQL Customer Account API. Initially, I tried following the instructions which leads to obtaining the obtain access token using browser’s console (Chrome Dev Tools). I was successful in doing this.**

However, when I tried to move over the code to authenticate the logged in user inside of Customer Account Extensions, when I reached the step of obtaining access token which calls** https://shopify.com/authentication/xxxxxxxx/oauth/token, I am encountering a CORS error:

Access to fetch at 'https://shopify.com/authentication/xxxxxxxx/oauth/token' from origin '``https://extensions.shopifycdn.com``' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present load-de593ea... html: 1

image
image1920×952 150 KB

With that being said, am I missing any step in the process and is it totally possible to call GraphQL Customer Account API endpoints from within Customer Account Extensions?

If no, is there any other way to obtain the customer access token from Customer Account Extensions?

Ideally we are looking to avoid creating a separate app and maximize Customer Account Extensions APIs, however, if there is no choice, I am open to hear solutions that will require us to build an app if that’s the worst case scenario.

I hope to hear from the community.

Thank you!

2

Hey,

Yeah the endpoint you are trying to call is designed for the backend only and not meant to be called publicly as it would expose your secret.

You can use the session token on the customer account api to get it for the user

Alternatively you can just call fetch with your graphql query as in this example and don’t have to manually authenticate