ID Token API
App Bridge isn't versioned with Polaris. App Bridge APIs and web components are identical in every App Home reference version.
App Bridge isn't versioned with Polaris. App Bridge APIs and web components are identical in every App Home reference version.
The ID Token API retrieves an OpenID Connect ID Token from Shopify as a JWT string. Your backend can verify this token to confirm that a request came from an authenticated Shopify user.
In most cases, you don't need to call this method directly. App Bridge's fetch interceptor automatically includes the ID token in the Authorization header for requests to your app's domain. Use shopify.idToken() directly when you need the token for something other than a standard fetch request, such as a WebSocket connection to your backend.
For more information, see the ID token documentation.
Anchor to Use casesUse cases
- Backend authentication: Verify requests to your backend are from a Shopify-authenticated user.
- Session validation: Validate user sessions without requiring traditional cookie-based authentication.
- Secure communication: Exchange ID tokens for secure communication between your app frontend and backend.
Send ID tokens to your own backend only. Verifying the signature requires your client secret, so a third-party service can't check it without a credential that also lets it mint tokens your app would accept.
Anchor to IdTokenApiId
The API is available on the shopify global. It returns a Promise that resolves to a JWT string.
Anchor to IdTokenApi-returnsReturns
js
Examples
Description
Retrieve an ID token from Shopify. The returned value is a JWT string that your backend can verify to authenticate the request.
js
const token = await shopify.idToken(); // => 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...'Description
Pass the ID token when opening a WebSocket connection to your backend. This is a common use case for calling `shopify.idToken()` directly, since the fetch interceptor only handles standard fetch requests.
js
const token = await shopify.idToken(); const socket = new WebSocket( `wss://your-app.example.com/ws?token=${token}` );