POS UI extension direct API access returns 401 unauthorized

Extensions
21

Thanks! I think it was Feb. 5th.

We tried again with an admin user logged in to the store and it worked. Can you explain a bit more about permissions for me? If I am using an offline access token does the store need to be logged in with enough permissions but not the staff member who enters their pin? Or does it just need to be authorized once or something?

22

@Wilen_Consulting - thanks for sending those logs over, I was able to pull them up and dig into this on our end!

It seems like there are actually two separate things going on here. For the intermittent 401 errors, the logs show that when the POS app resumes from the background, the access token can expire and needs to be refreshed. If you see this pop up again though and it’s constantly returning 401s, I’d recommend doing a full logout and login to clear any stale token state, and also updating to the latest POS app version if you haven’t already (the logs show 10.19.2, and 10.20.0 is available).

For the “User does not have access for this feature” error on cashTrackingSession, this is actually a separate permissions issue. I was able to confirm that the staff member who enters their PIN still needs the appropriate permissions for the specific resource being queried in order for the permissions to be passed. The logs show two different staff members on this device: one with a limited “Other stores” role and one with a full “Manager” role. The limited-role staff member likely doesn’t have read_cash_tracking access at the staff level, even if app’s OAuth scopes allow it. So you’d just want to make sure any staff members who need to use this feature have the right POS permissions assigned to their role in the Shopify Admin.

Let me know if this clears things up or if I can help with anything else here!

23

Thank you for your help!

24

Hey @Wilen_Consulting - glad that helped! Just wanted to follow up and see if everything’s working as expected on your end now, and if so I’ll go ahead and close this one out. If anything else comes up though, feel free to ping me here and I can take a look!