graphql-js-client Authentication

[ishahrier]

Hi

I have an app store public app that I am working on. I would like to know is it possible to use graphql-js-client library in the app front end (not storefront) to access admin API.

Because from the example on git hub i created the client in my app like the code below and it doesn't work (spits out 403).

    this.client = new GraphQLClient(types, {
      url: "https://dev-3-store.myshopify.com/api/graphql",
      fetcherOptions: {
        headers: {
          'X-Shopify-Storefront-Access-Token': 'access token',
        }
      }
    });

But if I create a private app credential in the dev store admin portal and use the "store-front-api-key" (not the other access token) 

then it works.

So my question is, then this "graphql-js-client" , it can not be used in public app's front end /ui? Because i understanding is that during public app installation you do not receive a store-front-access-token but only a regular access token to talk to the admin API.

 Please help me out here!

[Kevin_A]

Hey @ishahrier 

If you use the graphql-js-client library to access admin API from your app front end, you would essentially be revealing your private API key. So while it is technically possible, I don't think it is recommended. 

[ishahrier]

Hi

what if my app first authorizes the store using the oauth . after that a customer is logged into my app and then the front end receives the api key from the back end and does the graph-js-client calls.

is it also considered as an issue ? 

[Kevin_A]

Hey @ishahrier 

As long as you aren't exposing your API secret or any private tokens you should be fine.