IntegrationsUpdated 2026-08-25

Allow website access to store data

What this article helps you do

Understand why Mapstore’s public store endpoint works from storefront JavaScript but can reject requests from a server, command-line tool, or local file.

How Mapstore checks requests

Use the direct endpoint:

https://app.usemapstore.com/api/public/entities

Each request must have:

  1. A shop query parameter with the permanent *.myshopify.com domain.
  2. A browser Origin header from an external web page.

In production, the origin must use HTTPS and cannot contain an explicit port. Mapstore returns its CORS permission to that request origin. Browsers set the header automatically. Do not set the header in theme JavaScript.

This check accepts an external HTTPS origin value. It does not prove that the caller is a browser or that the origin belongs to the shop named in the query. Only use the endpoint for location data you intend to publish on a storefront.

Where to make the request

Run the request in storefront JavaScript, for example from a theme asset or custom section. Do not put the request in Liquid server-side code, a backend job, or a command-line script. Those environments usually have no storefront browser origin and receive a 403 response.

The default production gate rejects localhost and custom-port origins. Test from a deployed HTTPS storefront.

Troubleshooting

Issue Fix
400 response Add the store’s permanent *.myshopify.com domain as shop.
403 response Make the call from storefront browser JavaScript on an external HTTPS page without a custom port.
Browser reports a CORS error Check the response status in the Network panel. Make sure that the page uses HTTPS without a custom port.
cURL or a server job is rejected Non-browser clients do not usually send the required Origin header. Use this endpoint for storefront code.
Previous /apps/mapstore/... URL returns 404 Replace the retired app-proxy path with the direct endpoint above.