Introducing cookieless authentication beta with App Bridge

I think you both aren’t understanding the point of JWT. It’s stateless authentication. It has no knowledge if you are storing offline or online access tokens behind the scenes. A JWT sub will always be a user id because it’s the user who is invoking the action. If it’s an offline token, simply use the domain to pull the token via the domain. myshopify domains don’t recycle and cannot be changed. You can add an uninstall webhooks that trigger right at uninstall and you also receive revoke webhooks automatically if you don’t have an uninstall webhook. You’re making it way more confusing than it needs to be.

Offline token? Use dest for the check to grab the offline token.

Online token? Use sub.

Hell you could even make another table that associates user_ids with a specific domain.