Theme App Extension + App Proxy: How to authenticate logged-in customers with New Customer Accounts?

Extensions
,
1

Hi everyone,

I’m building a Shopify app that includes:

  • A Theme App Extension rendering a chat UI on a public storefront page

  • An App Proxy route (/apps/my-app/chat/session)

  • A backend that issues a short-lived chatToken for WebSocket authentication

The requirement is:

  • Guests can connect and view chat

  • Logged-in customers must be authenticated to send messages

Works with Classic Accounts

With Classic Customer Accounts, this works fine using:

  • logged_in_customer_id from the App Proxy request

  • Server issues a chat token based on that ID

Problem with New Customer Accounts

The store is using New Customer Accounts (Customer Account API).

I’m trying to implement authentication without reverting to Classic, but I’m hitting these issues:

:one: sessionToken.get() not available in Theme

I attempted:

import("@shopify/customer-account-ui-extensions")

This fails in theme runtime. It appears sessionToken.get() is only available inside Customer Account UI Extensions, not Theme App Extensions.

:two: authenticate.public.customerAccount(request) always returns 401

In my App Proxy route:

await authenticate.public.customerAccount(request)

This always returns 401 because:

  • App Proxy requests do not include an Authorization header

  • No Customer Account JWT is present

  • Customer identity is not forwarded automatically

My Question

Is there a supported way to authenticate a logged-in customer from:

Theme App Extension → App Proxy route

when using New Customer Accounts, without reverting to Classic?

Specifically:

  • Is there a way to obtain a Customer Account JWT in theme JS?

  • Does Shopify forward Customer Account identity to App Proxy in any supported flow?

  • Is redirect-based authentication required?

  • Is this currently unsupported architecture?

Constraints

  • Chat UI must live in a Theme App Extension

  • It runs on a public storefront page

  • WebSocket authentication requires a backend-issued token

I’d appreciate guidance on the recommended architecture for this setup.

Thanks in advance!