Skip to main content

Session API

The Session API provides access to current POS session information and secure authentication tokens, allowing you to retrieve shop details, user information, location data, and generate tokens for secure backend communication. The API includes both static session data and dynamic token generation for authenticated API calls.

  • API authentication: Authenticate API calls to your app's backend using secure session tokens.
  • Shop customization: Customize extension behavior based on shop domain, location, or currency.
  • Location features: Implement location-specific features like tax calculations or inventory checks.
  • Activity tracking: Track user activity and staff interactions for analytics and audits.
Support
Targets (23)

The shopify global object provides session details and authentication methods. Access the following properties on shopify to get session information, device identifiers, and generate authentication tokens.

Anchor to currentSession
currentSession
required

Provides information about the current POS session including shop details, user authentication, location data, currency settings, and POS version. Use session.staffMember to access the staff member currently pinned into POS and subscribe to staff member changes.

Anchor to deviceId
deviceId
number
required

The numeric ID of the device running this session.

Use this to construct a GID to query device details via GraphQL Admin API.

Anchor to getSessionToken
getSessionToken
() => Promise<string>
required

Generates a fresh session token for secure communication with your app's backend service. Returns undefined when the authenticated user lacks proper app permissions. The token is a Shopify OpenID Connect ID Token that should be used in Authorization headers for backend API calls. This is based on the authenticated user, not the pinned staff member.

Anchor to staffMember
staffMember
< | undefined>
required

Provides read-only access to the staff member currently pinned into POS and allows subscribing to staff member changes. The value is undefined when no staff member is pinned in.

Examples

jsx

import {render} from 'preact';
import {useState, useEffect} from 'preact/hooks';
// Allows the use of `shopify.session.staffMember.value` as a stateful subscription.
import '@shopify/ui-extensions/preact';

export default async () => {
render(<Extension />, document.body);
};

const Extension = () => {
const session = shopify.session.currentSession;
const [staffMember, setStaffMember] = useState(
shopify.session.staffMember.value
);

useEffect(() => {
const unsubscribe = shopify.session.staffMember.subscribe((newStaffMember) => {
setStaffMember(newStaffMember);
});
return unsubscribe;
}, []);

return (
<s-page heading="Current Session">
<s-scroll-box>
<s-stack direction="block">
<s-section heading="Shop Information">
<s-text>Shop ID: {session.shopId}</s-text>
<s-text>Shop Domain: {session.shopDomain}</s-text>
<s-text>Currency: {session.currency}</s-text>
</s-section>
<s-section heading="User & Staff">
<s-text>User ID: {session.userId}</s-text>
<s-text>Location ID: {session.locationId}</s-text>
{staffMember && (
<s-text>Staff Member ID: {staffMember.id}</s-text>
)}
</s-section>
<s-section heading="System">
<s-text>POS Version: {session.posVersion}</s-text>
</s-section>
</s-stack>
</s-scroll-box>
</s-page>
);
};

  • Handle authentication properly: Check for undefined session tokens and implement proper fallback behavior when authentication fails or permissions are insufficient.
  • Use appropriate identifiers: Distinguish between currentSession.userId (authenticated account) and staffMember (pinned staff member) to implement correct permissions and personalization logic. Read the staff member from the reactive shopify.session.staffMember signal rather than caching it, because it changes when a different staff member pins in.
  • Implement location-aware features: Use locationId and currency information.
  • Secure backend communication: Use session tokens exclusively for backend API calls and never expose them in client-side logs or storage. Validate tokens on your backend before processing requests.

  • Session tokens are only available when the authenticated user has proper app permissions enabled—staff members who are pinned in but not authenticated can't generate tokens.
  • Session tokens should only be used for communication with your app's configured backend service and can't be used for direct Shopify API calls from the client side.

Was this page helpful?