Authenticating customers in theme app extension

[wristbands]

Hey so we are developing a theme app extension, which creates an app block that will be used for customers to enter in additional account information. Our app block will send a request containing the additional information to our backend app server, which will use the Shopify Admin API to insert the data on behalf of the customer.

However, our problem is we want to make sure that each customer can only add additional information for their own account, not for other customers' accounts. To do this, we need some way of authenticating each customer in their request. Is there some way of accessing a customer's session token and verifying that it is valid in our backend app server? Would Access tokens for the Storefront API be relevant?

Thanks,
Elias

[EcomGraduates]

In order to authenticate each customer and ensure they can only add additional information for their own account, you can make use of Shopify's API authentication features.

Specifically, you can use the Shopify Admin API to obtain a session token for each customer when they log in. This token can then be passed along with each request to your backend app server, which can verify the token's validity and use it to perform actions on behalf of the customer.

Access tokens for the Storefront API would not be relevant in this case, as they are used for accessing storefront data rather than authenticating customer requests.

[wristbands · Accepted solution]

I was able to figure it out. You have to use App Proxies.

Once you set that up, you can determine the ID of the logged in user who sent the request by reading the `logged_in_customer_id` query parameter, and you can make sure that the request came from Shopify by verifying the `signature` query parameter. For a Node.js app, you can verify the signature using the shopify-application-proxy-verification npm library.

Hope that helps anyone in a similar situation!