Theme App Extension + App Proxy: How to authenticate logged-in customers with New Customer Accounts?

Extensions
,
1

Hi everyone,

I’m building a Shopify app that includes:

  • A Theme App Extension rendering a chat UI on a public storefront page

  • An App Proxy route (/apps/my-app/chat/session)

  • A backend that issues a short-lived chatToken for WebSocket authentication

The requirement is:

  • Guests can connect and view chat

  • Logged-in customers must be authenticated to send messages

Works with Classic Accounts

With Classic Customer Accounts, this works fine using:

  • logged_in_customer_id from the App Proxy request

  • Server issues a chat token based on that ID

Problem with New Customer Accounts

The store is using New Customer Accounts (Customer Account API).

I’m trying to implement authentication without reverting to Classic, but I’m hitting these issues:

:one: sessionToken.get() not available in Theme

I attempted:

import("@shopify/customer-account-ui-extensions")

This fails in theme runtime. It appears sessionToken.get() is only available inside Customer Account UI Extensions, not Theme App Extensions.

:two: authenticate.public.customerAccount(request) always returns 401

In my App Proxy route:

await authenticate.public.customerAccount(request)

This always returns 401 because:

  • App Proxy requests do not include an Authorization header

  • No Customer Account JWT is present

  • Customer identity is not forwarded automatically

My Question

Is there a supported way to authenticate a logged-in customer from:

Theme App Extension → App Proxy route

when using New Customer Accounts, without reverting to Classic?

Specifically:

  • Is there a way to obtain a Customer Account JWT in theme JS?

  • Does Shopify forward Customer Account identity to App Proxy in any supported flow?

  • Is redirect-based authentication required?

  • Is this currently unsupported architecture?

Constraints

  • Chat UI must live in a Theme App Extension

  • It runs on a public storefront page

  • WebSocket authentication requires a backend-issued token

I’d appreciate guidance on the recommended architecture for this setup.

Thanks in advance!

2

Have you figured this out?

4

Hey @skillmatic - thanks for bringing this thread back up. Since @Anychain’s original post is from February, I can’t confirm whether they found a solution but we can definitely explore this further.

Shopify documents shopify.sessionToken.get() as a Customer Account UI Extension API. I couldn’t find documentation stating that it’s available in Theme App Extensions. authenticate.public.customerAccount(request) is documented for requests from customer account extensions and returns their validated session token.

App Proxy requests use a separate authenticator: authenticate.public.appProxy(request). The App Proxy documentation states that Shopify adds logged_in_customer_id for a logged-in customer and leaves it empty when no customer is logged in.

There is an internal investigation into reports of logged_in_customer_id being empty with current customer accounts. This confirms that similar reports exist, but it doesn’t confirm that the same issue caused the behaviour described here. I don’t also don’t have a confirmed timeline to share. Direct Customer Account API authentication uses an authorization-code flow, with PKCE for public clients and a registered redirect URI.

@skillmatic, if you’re currently encountering this, could you share a redacted reproduction with the UTC timestamp, when it began, whether it’s consistent or intermittent, whether the Liquid customer object is available, the App Proxy response status, which authentication function is called, and whether logged_in_customer_id is present or empty? A screenshot of the browser Network entry showing the request path and any redirects would also help. Please remove the signature, cookies, authorization headers, customer ID, and other personal data. Don’t post a full HAR publicly, since HAR files can contain sensitive session information. Alternatively, I can also send you a DM if you’d like to share this information outside of the public forum

Hope this helps!

5

Hi @Wes-Dev-Shopify, I have not encountered the missing or empty logged_in_customer_id yet. But my client’s store is planning on moving to New Customer Accounts at some point (still not sure when the real deadline will be), and a large part of their store relies on a Rails app, which heavily relies on logged_in_customer_id. I’ve been testing a bit in a staging environment, and have not personally encountered the issue, but I’m aware of it from previous reports.