Using shopify api from theme extention

Shopify Apps
1

Hi all,

I want to use the shopify api (specifically the rest api for discounts codes) from my theme ext. in product page.

My ext. contains some javascript and liquid and im not sure how exactly the call should be made. Via external proxy server? client? or anything else?
Thank you in advance.

D.

2

You should hide the call behind an external proxy server because requests to Shopify API need to provide access token, which is very sensitive.

You should also implement some security (csrf token) or rate limit to that endpoint.

3

For a use case like discount code lookups, the request is typically made by having your Theme Extension send the request to a server side application. The server side application performs the authenticated Shopify Admin API call and returns only the information the storefront needs.

This pattern is used because Shopify Admin API requests require an Admin API access token. Since Theme Extensions run in the storefront, anything delivered to the browser can be inspected by anyone visiting your store. If an Admin API access token or any other confidential credential is included in your extension’s JavaScript or Liquid, it can be extracted and used by anyone visiting your store.

Standard Architecture

Theme Extension
        ↓
Shopify App Proxy
        ↓
Server Side Application
        ↓
Shopify Admin API

The Theme Extension sends only the discount code and any other storefront context needed for the request. The server side application performs the authenticated Shopify Admin API call and returns only the information the storefront needs.

Shopify App Proxy is commonly used for this pattern because it provides a Shopify routed URL that forwards requests to your server side application. The server side application can verify that the request came through the Shopify App Proxy, identify the originating shop, and optionally use the logged in customer context when Shopify provides it.

Important: The sensitive credentials still belong on the server side application. The App Proxy helps route and verify the storefront request, but the Admin API access token should be supplied only by the server side application when it calls the Shopify Admin API.

Example Implementation

The following open source example demonstrates this architecture using APIEase as the server side application, removing the need to build, deploy, and host your own backend.

Theme Extension
        ↓
Shopify App Proxy
        ↓
APIEase
        ↓
Shopify Admin API

Store owners can immediately use APIEase to securely make server side Shopify Admin API and third party API requests from a Theme Extension without exposing Shopify Admin API access tokens or other confidential credentials in the storefront.

Open source example

https://github.com/kevinstl-org/apiease-examples/tree/main/examples/shopify/discount-codes/details

Because the example is open source and versioned in GitHub, it can be cloned, customized, and iterated on using AI coding agents such as Codex or Claude Code. The customized solution can remain version controlled in GitHub while APIEase provides the managed server side execution.

The example shows a Shopify Theme Extension triggering a server side APIEase request through Shopify App Proxy that performs a Shopify Admin API Discount Code query while keeping the Shopify Admin API access token completely outside the storefront.