Authentication

StockrHub’s merchant API requires a Shopify App Bridge session token, also called an ID token. It does not accept a merchant-created API key or a supplier password as API authentication.

Embedded requests

The StockrHub frontend obtains a short-lived token through App Bridge and sends it to StockrHub in the authorization header:

Authorization: Bearer <Shopify App Bridge token>

The backend verifies the HS256 signature, audience, required time claims, and matching HTTPS Shopify issuer and destination. It then checks the store’s installation and applies that store’s context to the request. Changing an ID or URL parameter does not authorize access to another store.

Shopify distinguishes these short-lived identity tokens from the access tokens used by an app to call the Admin API. The frontend must obtain current identity tokens instead of treating one as a permanent credential. See Shopify’s ID token documentation.

Installation and background access

For a new managed installation, StockrHub can exchange a verified App Bridge token on the server, verify the Shopify store identity, and save that store’s encrypted offline access token. The application also retains an OAuth authorization-code callback with signed state and HMAC verification for its existing installation flow.

The backend uses the store’s Shopify access token for authorized Shopify work, including background operations. This access token is separate from the browser’s session token and from any supplier credentials. The documented production implementation does not provide a public offline-token API or external client credentials. A new installation remains in setup mode until reviewed.

Authentication failures

• A missing or invalid bearer token returns 401.
• Token verification failures can include X-Shopify-Retry-Invalid-Session-Request: 1, allowing the embedded client to request a current token.
• Temporary installation setup failures can return 503 with Retry-After.
• Inactive installations and operations restricted by setup mode can return 403.

Reopen StockrHub from the correct Shopify store if authentication does not recover. Do not copy tokens into browser URLs, support messages, external scripts, or another store. After an interrupted write, inspect its status before repeating it.

Webhooks use different authentication

Shopify webhook requests use a signature over the raw request body and validated shop/topic information. They do not use a browser session token. See Webhooks.