How to get sessionToken in Admin block/action Extension

Retired Boards Appdev Authentication

Topic summary

A developer is building a Shopify Admin Action Extension and needs to authenticate API calls to an external server (not Shopify’s Admin API). They attempted to import authentication functions from their web/frontend folder into the extension folder but encountered issues.

Shopify’s recommended approach:

  • Use Direct API Access for calls to Shopify’s Admin GraphQL API—these are automatically authenticated by default
  • For calls to the app’s own backend, use fetch() with the configured auth domain or subdomains—an Authorization header with an OpenID Connect ID Token is automatically added
  • No manual session token management is needed for these scenarios

Unresolved challenge:
One participant successfully received the Authorization header after initial difficulties. However, another developer asks about making requests to a separate server that is not the configured auth domain or subdomain, questioning whether manual session token management is possible in Admin UI Extensions. This specific use case remains open/unanswered in the thread.

Summarized with AI on November 10. AI used: claude-sonnet-4-5-20250929.
1

I am using Shopify Admin action extension and using network access outside Shopify.
In the web/front-end folder, I create authenic and I can get session in here.
But in the admin extension folder, I tried to import the authentic function from web/front-end folder to there but it’s not working.

My structure:

–extension

–admin-action-extension

–index.ts

–web

–frontend

–authenticate

–index.ts

Please help me. I was stack here in 3 days

2

Hi there :waving_hand:

If you are inside of an Admin Action Extension and you want to make an API call to Shopify you can use Direct API Access.

Any fetch() calls to Shopify’s Admin GraphQL API from your extension are automatically authenticated by default.

You can review this tutorial on using Direct API Access from within Admin Action extension

3

Thank for your reply but I don’t want to make a call API to Shopify’s Admin, I created an API outside from another server and I want to make a call API to there

4

Thank you for confirming your use case!

If you are making API calls to your apps backend, when you use fetch() to make a request to your app’s configured auth domain or any of its subdomains, an Authorization header is automatically added with a Shopify OpenID Connect ID Token. There’s no need to manually manage session tokens. Docs here

5

@nhtbao101 Is this solution working for you? I am using fetch(app:/path) from an admin extension, but am not getting an Authorization header sent with the request. https://community.shopify.com/post/2286912

6

Nevermind. I am now getting the header.

7

Hey @lizk , I am trying to make requests to a separate server that is not my configured auth or subdomain. Is there a way for me to manage session tokens manually in the admin UI extensions? Here is my question (https://community.shopify.com/topic/2525112))