How can a Customer Event Pixel send a secure cookie to an application?

Shopify Plus
, ,

Topic summary

A developer is struggling to implement conversion tracking via Shopify’s Customer Event Pixels due to cookie access limitations. The core issue:

Technical Problem:

  • Customer Event Pixels run in a sandboxed JavaScript environment
  • Secure cookies (HttpOnly/Secure flags) containing unique tracking IDs cannot be accessed via JavaScript for security reasons
  • The browser’s browser API also fails to retrieve these cookies
  • While conversion events fire correctly, the tracking ID needed for attribution is missing from requests

Current Workaround:
The team is forced to reimplement tracking through alternative tag management solutions like Google Tag Manager (GTM), which undermines the value of Shopify’s native Customer Event Pixels.

Broader Context:
The developer references similar unresolved posts from other developers facing cookie access issues during checkout, suggesting this is a systemic limitation with checkout extensibility.

The discussion remains open, seeking clarification on whether there’s a misunderstanding of the architecture or if this represents a fundamental constraint of Shopify’s sandboxed pixel implementation.

Summarized with AI on October 28. AI used: claude-sonnet-4-5-20250929.
1

I have an application with conversion tracking that we have implemented via Customer Event Pixels. The conversion events fire correctly, however the unique ID that is stored in a cookie is not included in the request due to the sandboxed nature of the JS. Further, it is not possible to retrieve this cookie with JS because it is, as it should be, a secure cookie (https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies) which browsers prevent from accessing via JS. I tested to confirm this by using the browser API (https://shopify.dev/docs/api/web-pixels-api/standard-api/browser).

This limitation drives us to reimplement these pixels in an alternate tag management solution (GTM in this case, but it could be any tag manager) which reduces the value of the customer event pixels and is still broken on checkout since GTM is loaded via a Shopify customer event pixel (i.e. in sandboxed JS) when using checkout extensibility.

I see a couple of other posts from developers describing a similar issue but without including the detail of whether the cookie is “secure” or not. I expect that all of these are related to the same fundamental issue: the browser does not allow JS to read secure cookie that would otherwise be included in the request from the top frame.

If I’m misunderstanding something here, please let me know.