Introducing a new Node library for accessing the Shopify Admin API

Vyacheslav81
New Member
1 0 1

I have a private shopify app therefore I don't have local application running and also I don't have envirement variable HOST. How can I use this library with private app if Shopify.Context.initialize function use a config object ContextParams needs to have HOST_NAME key?

I have npm package "@shopify/shopify-api" version 1.2.1 installed and it has no Storefront API implemented. I don't know why there is no Storefront API in this version of package considering that github repo release with the same version has that API implemented.

GoodfyLabs
Explorer
58 0 8

Hi @Vyacheslav81  ... that was my intention too ...( use with PRIVATE APPS) 

I did some tests and ... in fact I realize that did not work because do not make SENSE ( at least this was my understanding ) 

 

Because with Private apps ... you will authenticate every api call using key and password  ... 

Maybe  an expert can explain better

Best regards 

William Alencar
GoodFy Labs
Brazilian Shopify Experts
Getting Satisfied Customers around the World
Skype : william.br1
0 Likes
RileySeaburg
Tourist
3 0 0

Thank you so much for sharing this!

0 Likes
dgtlmonk
Tourist
6 1 0

@dylanpierce doesn't seem to work with Custom App? Custom app requires API Secret which the configuration (env file) doesn't have. So I suppose  your framework is only for Private Apps?

 

dgtlmonk_0-1620729859756.png

 

0 Likes
dylanpierce
Shopify Partner
138 2 42

@dgtlmonk no it's compatible with both private & public apps.

You may have mixed up and created an `.env` file but NextJS by default reads `.env.local`.

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely
luistmartins
Tourist
6 0 1

@dylanpierce apologies for deviating from the main topic, but do you have an example of how can a NextJS API route could consume the `sessionToken` for axios REST Admin API requests? I'm really close to have this working but I think I'm missing a critical step somewhere.

0 Likes
dylanpierce
Shopify Partner
138 2 42
@luistmartins

There is a middleware called "withSessionToken" in the package.

In the example repo look at the API route that is called within the
pages/home.js frontend component.

This withSessionToken middleware verifies the authenticity of the session
token and sets req.shopName to the name of the shop that's currently logged
in.

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely
luistmartins
Tourist
6 0 1

Thank you @dylanpierce, for the help here and for this useful library.
My difficulty was taking the accessToken given out by the middleware and use that to make REST Admin API requests, and that was because I was not passing the information through the `X-Shopify-Access-Token` header, which solved it for me, hopefully the proper way.

0 Likes
dgtlmonk
Tourist
6 1 0
dylanpierce
Shopify Partner
138 2 42

@luistmartins 

Oh I’m sorry, I misunderstood session token with access token.

For others reading this:

* Session Token == the frontend JWT authentication token for proving your merchant’s identity
* Access Token == the backend private key that represents your access to the merchant’s resources within the Shopify Admin API

The idea behind the session token is that it’s publicly accessible in the browser, but it will eventually expire.

The withSessionToken middleware proves that the merchant is using your app and is authenticated - however its up to your implementation to pull the shop’s Access Token from your backend database given the shop’s name (aka origin).

The next-js-shopify-toolbox package gives you the relevant middleware to retrieve this Access Token during OAuth, but it’s up to you to decide where to store it and how to retrieve it later.

Founder of Verdict - Anti-Fraud Apps for Shopify
  • Blockade - Easily block countries, IP addresses, VPNs
  • Real ID - Verify your customer's real IDs easily & securely