Understand Shopify app proxy requirements for Mapstore APIs

What this article helps you do

Understand how Mapstore API requests are protected when used from your storefront. Requests go through Shopify’s app proxy so only valid storefront visitors can access store data.

Before you start

• Mapstore is installed on your Shopify store
• You use or plan to use Mapstore APIs from your theme (e.g. fetching store data)

Step-by-step instructions

1. What is the app proxy

• The app proxy is a Shopify feature that routes requests from your storefront (e.g. yourshop.com/apps/mapstore/...) to Mapstore.
• Shopify adds validation (e.g. shop domain, session) so Mapstore knows the request is from a real visitor on your store.

2. Why it matters for Mapstore

• Mapstore uses the app proxy so API requests (e.g. store list, search) come from your store’s domain and are validated.
• This prevents unauthorized access and ensures only your storefront can call Mapstore’s storefront APIs.

3. Use the correct URL path

• When calling Mapstore APIs from your theme, use the app proxy path (for example /apps/mapstore/api/entities).
• Do not call Mapstore’s backend URL directly from the storefront; those requests may be rejected.

4. Shopify handles validation

• Shopify signs or validates requests going through the proxy.
• Mapstore checks this validation before returning data.

5. If requests fail

• Confirm the app proxy is set up for Mapstore in your Shopify admin (App proxy is usually configured by the app).
• Ensure your theme uses the proxy path, not a direct external URL.

How to verify it worked

• API calls that use the app proxy path succeed and return store data.
• Direct calls to Mapstore’s backend from the storefront fail or are blocked (expected behavior).

Common issues and fixes

Related articles

• Use Mapstore storefront API endpoints in themes
• Configure Google API key and required APIs
• Add Mapstore blocks to your theme
• Exporting store data