JWT specification

This document describes how JWTs (JSON web token) need to be structured in order to be used in post-purchase app extensions on the Shopify checkout. It describes the claims that can be used, and whether they're optional.

Anchor to OverviewOverview

The data passed from Shopify to the extension point is signed with a shared secret (JWT). When you make a call to your backend server, you can use this secret to verify that the request came from Shopify. The following example displays how you can use a changeset token to request changes to an initial purchase:

extend('Checkout::PostPurchase::Render', async (root, input) => {

const buyNowButton = root.createComponent(Button, {

onPress() {

const changeset = await fetchChangeset(input);

input.applyChangeset(changeset.token);

});

const pagePayload = input.storage.initialData;

buyNowButton.appendChild(`Buy "${pagePayload.variantTitle}" now!`);

root.appendChild(buyNowButton);

root.mount();

});

// this call would ideally fetch all available changesets at once, instead

// of one at a time

const fetchChangeset = async (input) => {

const request = await fetch('https://example.com/fetch-changeset', {

method: 'POST',

body: JSON.stringify({ initialPurchase: input.initialPurchase.token }),

});

return request.json();

};

If your app makes a return call to your extension point, then you must sign applyChangeset with the shared secret. Shopify will use the secret to verify that the request is coming from your app.