How app-proxy requests are verified
What this article helps you do
Understand how Shopify forwards store data requests to Mapstore and how Mapstore verifies them.
How Mapstore checks requests
Use this path on your Shopify storefront:
/apps/mapstore/api/entitiesShopify forwards the request to Mapstore with the shop identity and a
signature. Mapstore verifies the signature before it returns active locations.
You do not need to add a shop parameter or generate a signature in theme
JavaScript.
Invalid signatures receive a 401 response. Requests for a shop that Mapstore
cannot find receive a 404 response. Requests for a banned shop receive a
401 response.
The signature verifies that Shopify forwarded the request. It does not require the shopper to sign in. Only mark locations Active when you want shoppers to see them.
Where to make the request
Call the relative path from storefront JavaScript, such as a theme asset or custom section. The request goes to your shop’s domain, where Shopify handles the app proxy.
If you changed the app-proxy path in Shopify, use that path instead of
/apps/mapstore.
Troubleshooting
| Issue | Fix |
|---|---|
401 response |
Use the app-proxy path on your shop’s domain so Shopify signs the request. |
404 response |
Check that Mapstore is installed and that the URL uses your shop’s configured app-proxy path. |