Token exchange returns invalid_subject_token

[remy727]

Aha, looks like you want to decode JWT.

How to authenticate request with session tokens manually?

Hey Remy! Session token is not an HMAC but a JWT. You would need to decode the JWT. We use python (Django) to decode it but I took some help from AI and got this code for ROR. def verify_session_token session_token = request.headers['Authorization'] begin payload = JWT.decode( session_token, Rails.configuration.shopify_api_secret, true, { algorithms: ['HS256'], aud: Rails.configuration.shopify_api_key, leeway: 10 } ).first …