Authenticating with custom API using Shopify customer account for React Native app logins

[ajohns]

Community Help Request

Hi All,

I wonder if anyone can advise me.

Does anyone know how to build custom APIs that a customer could authenticate with using their Shopify email and password?

My use case is this:

It’s my first time developing a React Native app and I’ve developed some API endpoints (Ruby on Rails) for it to use. This API has been added to a custom Shopify app I’ve developed for my store to add functionality such as wishlists and other custom data. As the API needs access to this data also I’ve built it into this Shopify app.

Now I want to secure my API so that a mobile app user needs to be logged in to access the API and get their specific Wishlist. For now the mobile app will just connect with my API but later I’ll want to connect to things like the Storefront API eg for add to basket. I want the mobile user to be able to login once and remember their login and then be able to connect to my API and the shopify API.

I don’t see any way for my API to validate a user’s credentials via Shopify eg Admin API or app proxy etc. Authenticating with the Storefront API will let me know the users credentials are correct and let me get the customer ID but that’s not going to gain me access to my own API.

All I can think of doing at this point is the following (assuming the customer already has a Shopify account):

1. Customer enters email and password in the app and then I authenticate with the storefront API
2. In my API I will add an API users table that stores login details for a shopify customer ID. Once the user authenticates successfully with the storefront API I then create a new API user account using the entered username and password + the customer shopify ID I get back from the storefront API
3. I’d store the users login details in React Expo SecureStore for using for future logins to both APIs

I’m not sure how secure this is as a solution or if there’s a better way I can do all this.

Any help would be greatly appreciated, thanks!