Session Token API

Examples

• Using a session token with fetch()

  Description

  You can request a session token from Shopify to use on your application server. The contents of the token claims are signed using your shared app secret so you can trust the claims came from Shopify unaltered. Note: You will need to [enable the `network_access` capability](/docs/apps/build/checkout/capabilities#network-access) to use `fetch()`.

  React

  import {useEffect} from 'react';
  import {
    reactExtension,
    Banner,
    useApi,
  } from '@shopify/ui-extensions-react/checkout';
  
  export default reactExtension(
    'purchase.checkout.block.render',
    () => <Extension />,
  );
  
  function Extension() {
    const {sessionToken} = useApi();
  
    useEffect(() => {
      async function queryApi() {
        // Request a new (or cached) session token from Shopify
        const token = await sessionToken.get();
        console.log('sessionToken.get()', token);
  
        const apiResponse =
          await fetchWithToken(token);
        // Use your response
        console.log('API response', apiResponse);
      }
  
      function fetchWithToken(token) {
        const result = fetch(
          'https://myapp.com/api/session-token',
          {
            headers: {
              Authorization: `Bearer ${token}`,
            },
          },
        );
        return result;
      }
  
      queryApi();
    }, [sessionToken]);
  
    return (
      <Banner>See console for API response</Banner>
    );
  }

  JavaScript

  import {
    extension,
    Banner,
    BlockStack,
  } from '@shopify/ui-extensions/checkout';
  
  export default extension(
    'purchase.checkout.block.render',
    (root, {sessionToken}) => {
      async function queryApi() {
        // Request a new (or cached) session token from Shopify
        const token = await sessionToken.get();
        console.log(token);
  
        const apiResponse =
          await fetchWithToken(token);
  
        // Use your response
        console.log(apiResponse);
      }
  
      function fetchWithToken(token) {
        const result = fetch(
          'https://myapp.com/api/session-token',
          {
            headers: {
              Authorization: `Bearer ${token}`,
            },
          },
        );
  
        return result;
      }
  
      queryApi();
  
      root.appendChild(
        root.createComponent(Banner, {
          title: 'Session Token Extension',
        }),
      );
    },
  );

• Description

  The contents of the token are signed using your shared app secret. The optional `sub` claim contains the customer's `gid` if they are logged in and your app has permission to read customer accounts. For example, a loyalty app that needs to check a customer's point balance can use the `sub` claim to verify the customer's account. Caution: > Your app server can only trust the claims within the session token. It cannot use the token to trust the entire HTTP request. See [security considerations](/docs/apps/build/checkout/capabilities#network-access) for details.

  session-token.jwt

  {
    // Shopify URL
    "dest": "store-name.myshopify.com",
    // The Client ID of your app
    "aud": "<clientId>",
    // When the token expires.  Set at 5 minutes.
    "exp": 1679954053,
    // When the token was actived
    "nbf": 1679953753,
    // When the token was issued
    "iat": 1679953753,
    // A unique identifier (a nonce) to prevent replay attacks
    "jti": "6c992878-dbaf-48d1-bb9d-6d9b59814fd1",
    // Optional claim present when a customer is logged in and your app has permissions to read customer data
    "sub": "gid://shopify/Customer/<customerId>"
  }