Interacting with Shopify Admin
Learn how to authenticate and handle requests from Shopify Admin in your React Router app.
The authenticate.admin function handles authentication for embedded apps and merchant custom apps. It verifies app installation and provides context for interacting with the Admin API.
This guide covers authentication patterns, API usage, and request handling for your app.
Anchor to Authenticating requestsAuthenticating requests
To authenticate admin requests you can call authenticate.admin(request) in a loader or an action.
If there's a session for this user, then this loader will return null. If there's no session for the user, then the package will perform token exchange and create a new session.
If you are authenticating more than one route, then we recommend using React router layout routes to automatically authenticate them.
If you are authenticating more than one route, then we recommend using React router layout routes to automatically authenticate them.
Anchor to HeadersHeaders
When redirecting outside the app, and in certain error scenarios, the package will throw a response with specific headers.
To ensure the headers are set correctly use the provided ErrorBoundary and headers exports.
Anchor to Using the GraphQL APIUsing the Graph
Once a request is authenticated, authenticate.admin will return an admin object that contains a GraphQL client that can interact with the GraphQL Admin API.
Anchor to Authenticating cross-origin admin requestsAuthenticating cross-origin admin requests
If your React Router server is authenticating an admin extension, then a request from the extension to the server will be cross-origin.
Here authenticate.admin provides a cors function to add the required cross-origin headers.
Anchor to Using the GraphQL API in background jobsUsing the Graph
You may need to interact with the Admin API when working outside of Shopify requests. To do so use the unauthenticated.admin function.
This enables apps to integrate with 3rd party services and perform background tasks.
This function doesn't perform any validation and shouldn't rely on raw user input.
This function doesn't perform any validation and shouldn't rely on raw user input.
When using this function, consider the following:
Anchor to Background tasksBackground tasks
Apps should ensure that the shop domain is authenticated when enqueueing jobs.
Anchor to 3rd party service requests3rd party service requests
Apps must obtain the shop domain from the 3rd party service in a secure way.
