i am building a custom Shopify app that exposes a REST endpoint, and I am calling it from the storefront theme using AJAX:
$.ajax({
url: “https://myapp.com/api/update-access-codes”,
method: “POST”,
data: { code: “12345” }
});
The problem:
When I inspect the page or view the source, this endpoint is visible in the Liquid/JS code. Anyone can see it, copy it, or hit it directly — which is a security issue.
My questions:
How can I securely call my app API from the Shopify storefront without exposing the real backend URL?
Is there a way to hide or protect the API endpoint inside Shopify Liquid?