Store Locked Error When Fetching Storefront API on the server

GraphQL Admin API Troubleshooting
1

I created a basic backend server to fetch product data dynamically from the store. But my GraphQL request is responding with ‘Online Store channel is locked.’ Is there any way in which I can get the product data for the development stores?

app.get('/api/offer', async (_req: Request, res: Response) => {
  const sessionToken = _req.headers['authorization']?.split(' ')[1];
  if (!sessionToken) return res.status(401).json({ error: 'No Session Token Received' });
  try {
    const decoded = JWT.verify(sessionToken, process.env.SHOPIFY_API_SECRET as string) as {
      input_data?: {
        shop?: {
          domain?: string;
        };
      };
    };
    const response = await fetch(`https://${decoded?.input_data?.shop?.domain}/api/2025-07/graphql.json`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-Shopify-Access-Token': sessionToken
      },
      body: JSON.stringify({
        query: `query getProductsByIDs($ids: [ID!]!) {
            nodes(ids: $ids) {
              ... on ProductVariant {
                availableForSale
                id
                image {
                  url(transform: {maxWidth: 400})
                }
                price {
                  amount
                  currencyCode
                }
                compareAtPrice {
                  amount
                  currencyCode
                }
                product {
                  title
                  id
                }
              }
            }
          }`,
        variables: {
          ids: ['gid://shopify/ProductVariant/55922219450742', 'gid://shopify/ProductVariant/55922219516278']
        }
      }),
    });
    const data = await response.json();
    console.log(data);
    res.json({ response });
  } catch (error: any) {
    return res.status(401).json({ error: error.message });
  }
});

{
  errors: [
    {
      message: 'Online Store channel is locked.',
      extensions: [Object]
    }
  ]
[API] Invalid API key or access token For Extension Only App Backend
Building Post Purchase Offer In Typescript
2

Hey @Namish_Kapoor :waving_hand: - sending you a DM on this one :slight_smile:

3

It might be me, but every time I end up here looking for a solution, it makes me laugh…

this is a community whose sole purpose should be to share solutions to help each other.
What’s the point of sending the solution privately?!?
If it’s a staff member sending it, it’s even more hilarious.

Anyway, for anyone in the same boat:

the dev shop requires a password to navigate, and the same goes for the storefront API.

My workaround was:

  • to debug: navigate the home , get authenticated and run the call from the browser console
  • use the storefront api (tokenless) only from frontend (html javascript)
  • use the admin API from the back end in dev (i don’t know if there’s a way to authenticate and make the storefront call from server side… i’ve tried adding token but in vain)
4

Hey @emilianoc - totally hear you on public solutions being helpful! In this case, the issue required looking at a specific shop configuration/credentials, so DM was for privacy. When it’s a general solution, we definitely try to keep it public for everyone’s benefit.

Dev stores are indeed always password locked though like you mentioned. For using the Storefront API on a dev store though, you should be able to generate a storefront API token (more info here) and set up a request like this as an example:

curl -X POST \
  https://{shop}.myshopify.com/api/2025-10/graphql.json \
  -H 'Content-Type: application/json' \
  -H 'X-Shopify-Storefront-Access-Token: {storefront-access-token}' \
  -d '{
    "query": "{your_query}"
  }'

Let me know if this works when it comes to the token authenticated access way, if you run into any other issues feel free to ping me here and I can for sure take a look.

1 Like
5

super usefull and save me a lot of time , it’s much better than my workaround
thanks a lot

1 Like
7

@Alan_G Facing the same issue for a client’s password protected store?

1 Like
8

Hey @Sakshi_Gupta :waving_hand: - the method above should work for live merchant shops as well. You’d just need to make sure you’re accessing the shop using a valid X-Shopify-Storefront-Access-Token (a bit more info here). Let me know if you still run into issues though and I’d be happy to help out.