RealComposer
START FREE
Upstream APIsOfficial Shopify docs

Shopify Safe & Unsafe Practices

Direct Answer

Shopify Storefront API public access tokens are designed for clients and only expose storefront data. Admin API access tokens (shpat_) and app client secrets are server-only. Verify the X-Shopify-Hmac-Sha256 header on every webhook before trusting it.

Credentials & Where They Belong

Client safe
Storefront API public access token

Reads products and creates carts with storefront-level permissions.

Server only
Admin API access token (shpat_)

Reads and edits orders, customers, inventory, and settings.

Server only
App client secret

Signs webhooks and completes OAuth installs.

Safe Practices

  • Use the Storefront API for client reads

    Products, collections, and carts should come from Storefront, not the Admin API.

  • Verify webhook HMACs with the raw body

    Compute the base64 HMAC-SHA256 with your client secret and compare in constant time.

  • Request minimal Admin scopes

    Use read_products instead of write_products unless the integration edits the catalog.

Unsafe Practices

  • Using an Admin API token in a theme or headless frontend

    Anyone could read customer data or edit orders and prices.

  • Trusting webhook payloads without HMAC checks

    Attackers can post fake orders/paid events to your endpoint.

The RealComposer Pattern

Keep the Admin token in the vault for inventory and order lookups, cache catalog responses at the edge, and slim product payloads before they reach mobile clients.

START BUILDING FREE

Frequently Asked Questions

Q:Can I expose the Shopify Storefront token?

Yes, the public Storefront token is intended for clients. Use a private Storefront token only on servers.

Shopify Recipes

All Shopify recipes (8)
Frontend / WebShopify
Security & Secret Vault

Call Shopify Admin API from Frontend Store Securely

To solve call shopify admin api from frontend store securely, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebAirtableShopify
Multi-API Aggregation

Merge Airtable and Shopify into One API Response

To solve merge airtable and shopify into one api response, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebShopify
Multi-API Aggregation

Aggregate Shopify Customer Orders and Loyalty Points API

To solve aggregate shopify customer orders and loyalty points api, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

Webhook Signature Verification

Webhook signature verification is validating that an incoming webhook was sent by the expected provider and was not altered. Providers sign each payload with a shared secret, typically using HMAC-SHA256, and your endpoint recomputes the signature and compares it before trusting the event.

HMAC Authentication

HMAC authentication uses a hash-based message authentication code, computed from a message and a shared secret key, to prove that a request came from a holder of the secret and was not modified. The receiver recomputes the HMAC and compares it to the value sent.

Edge Caching

Edge Caching is the practice of storing computed API responses on globally distributed Point of Presence (PoP) servers situated geographically close to users. By serving cached responses directly from edge memory, requests achieve sub-10ms latencies while offloading 95%+ of traffic from origin databases.