Hello. I have added an order status extension, in which I get the session token and then make a request to my backend. There I’m trying to exchange the session token into an access token and get: "error": "invalid_subject_token", "error_description": "Token exchange cannot be performed due to …

@endor I’m trying to work with the seal subscriptions API. In order to do that I need the customer’s email, but the token only contains the id. I thought I read somewhere that only the token itself can be trusted, not the other data accompanying the request, but I can’t find the place anymore. …

Can you try with this? const token = req.query.id_token

Is that in the frontend or the backend? In neither I seem to have a req. In the backend I have access to the query parameters through the event, but since I’m sending the session token in the header, I’m not sending it in the query. Session Token suggests sending the session token in the header, li…

Aha, looks like you want to decode JWT. [image] How to authenticate request with session tokens manually? Authentication & Access Hey Remy! Session token is not an HMAC but a JWT. You would need to decode the JWT. We use python (Django) to decode it but I to…

shopify.auth.tokenExchange does the decoding for me. It’s a shopify lib function, so I would expect it to do the right thing.

I think you’re trying to use the session token from your order status extension to call the admin API from your server, right? This isn’t what this session token is for - it’s meant for you to validate that requests to your server are coming from Shopify and not a malicious third party. You would …

Yes, that’s what I want to do. Specifically I’d like to request some data about the customer based on their session token. What is the token exchange meant for, if not for using the session token to get an access token to request data from the API? If the token exchange is not meant for fetching c…

[image] endor: Yes, that’s what I want to do. Specifically I’d like to request some data about the customer based on their session token. Hey @endor , to query data about the customer, you should do that directly from your customer account extension, by querying the Customer Account API . The A…

Ah, okay, that makes a lot of sense. What I haven’t yet understood is this though: How can I take an action in my backend based on some of the customer’s data? I can verify that a certain customer id sent a request to my backend based on the session token, but how can I get the additional data th…

What are you trying to do exactly? Mutate customer data? Order data? Something else? If I request that data in the frontend and send it to my backend, it’s not guaranteed that this data is from my extension, only that the data in the session token is from my extension, right? No, this isn’t acc…

I’m trying to work with the seal subscriptions API. In order to do that I need the customer’s email, but the token only contains the id. I thought I read somewhere that only the token itself can be trusted, not the other data accompanying the request, but I can’t find the place anymore. Could you s…

Token exchange returns invalid_subject_token

Extensions

remy727 February 28, 2025, 2:40pm 4

Aha, looks like you want to decode JWT.

Topic		Replies	Views
Confused about subject_token for token exchange vs refresh (expired offline access token) Shopify App Store app-store	5	62	July 23, 2026
How to authentication session token API request came from customer account UI extension? Extensions customer-account-ext	2	147	March 24, 2025
Customer Account Extension API missing keys in session token Extensions customer-account-ext	1	125	December 18, 2024
How can Offline Session tokens be generated for new apps using the latest Shopify App Remix and Token Exchange Process App Bridge app-bridge	6	531	February 10, 2025
Sending Access Token to Remix app from App Extension Extensions theme-app-extension	4	177	February 28, 2025

Token exchange returns invalid_subject_token

Related topics