These pages refer to Hydrogen versions 2026-04 and earlier. For versions 2026-10 and later, refer to the latest Hydrogen docs. If you're not using the latest version of Hydrogen, then we recommend that you migrate your storefront. To learn more, refer to Migrate to the latest version of Hydrogen.
End-to-end testing
Learn how to run end-to-end tests against your deployment in your CI/CD workflow by creating an authentication bypass token.
Anchor to Step 1: Generate the authentication bypass tokenStep 1: Generate the authentication bypass token
-
Generate a deployment token in the Shopify admin.
-
Modify your CI/CD file to include the deploy command.
Terminal
npx shopify hydrogen deploy --auth-bypass-token --token $SHOPIFY_HYDROGEN_DEPLOYMENT_TOKEN -
The command outputs a file named
h2_deploy_log.json, which contains the deployment URL and the authentication bypass token that you can feed into your end-to-end testing system.
Authentication bypass tokens are supported only on the Oxygen deployment URL returned in h2_deploy_log.json (for example, *.myshopify.dev). They aren't supported on custom domains.
Authentication bypass tokens are supported only on the Oxygen deployment URL returned in h2_deploy_log.json (for example, *.myshopify.dev). They aren't supported on custom domains.
Anchor to Token durationToken duration
By default, tokens are valid for two hours. You can modify this duration by supplying the --auth-bypass-token-duration flag to the deploy command. The duration can be set to any whole number of hours from 1 to 12.
Terminal
Anchor to Example GitHub workflowExample Git Hub workflow
If you're using GitHub workflow files, then edit the deploy step per the following example. If you're using another CI/CD system, then refer to these example workflows.
.github/workflows/oxygen-deployment.yml
Refer to a live example in the Hydrogen Demo Store.
Anchor to Step 2: Embed the authentication bypass token in the request headerStep 2: Embed the authentication bypass token in the request header
Your end-to-end testing system must embed the token within the header before navigating to the deployment URL from h2_deploy_log.json. Authentication bypass tokens are supported only on that deployment URL, not on custom domains. If you send requests to a custom domain instead, redirects can prevent the oxygen-auth-bypass-token header from reaching Oxygen.