Hi @surfacenathan,
No, user dont need to re-authenticate your API. You can use session info from app bridge, and attach it as 'Session-Token' header in your request to Python API. Addtional, you need implement middleware to authorize that header (a simple JWT validator)
1. This is example code I am using in Remix App
import axios from 'axios';
import { useAppBridge } from '@shopify/app-bridge-react';
class Api {
constructor(path) {
this.instance = axios.create({
headers: {
'Content-Type': 'application/json',
}
});
this.instance.interceptors.response.use(this.handleResponse, this.handleError);
this.instance.interceptors.request.use(async (config) => {
if (typeof window !== "undefined") {
config.baseURL = `${window.ENV.API_URL}/${path}`
this.app = useAppBridge();
config.headers['x-session-token'] = await this.app.idToken()
} else {
config.baseURL = `${process.env.API_URL}/${path}`;
}
if (!config.headers['x-session-token']) {
console.log(`Can't find session token`) // eslint-disable-line
}
return config
}, this.handleError);
}
async handleResponse(response) {
const { code } = response.data;
if (code === 401 || code === 403) {
console.log('==code === 403==') //eslint-disable-line
}
return response.data;
}
handleError = (error) => {
return P
2. This is the example code to authorize request but in Javascript (koa.js), SHOPIFY_API_SECRET_KEY is your app secret key in partner app API access section.
module.exports = async (ctx, next) => {
const token = ctx.request.headers['x-session-token'];
if (token) {
try {
const payload = jwt.verify(token, SHOPIFY_API_SECRET_KEY);
await next();
} catch (err) {
console.error(err.toString());
return ctx.body = {
code: 401,
error: true,
message: 'Unauthorized access.',
err
}
}
} else {
console.error("No token provided.");
return ctx.body = {
code: 403,
error: true,
message: 'No token provided.'
}
}
}
Here the Shopify doc about session tokens: https://shopify.dev/docs/apps/build/authentication-authorization/session-tokens
Hope this can help you somehow.
