Shopify Custom App - Storefront API 403

Retired Boards Appdev Custom Storefronts
,
1

I’m trying to setup a new custom app to serve as a staging environment for a production app that’s working fine.

When trying to use this app in a new store, I’m getting a 403 error when trying to query the Storefront API. For example:

const { storefront } = await unauthenticated.storefront(shopDomain);

const response = await storefront.graphql(
  `query ProductQuery($productId: ID!) {
    product(id: $productId) {
      id
      title
      variants(first: 10) {
        edges {
          node {
            id
            sku
          }
        }
      }
    }
  }`,
  { variables: { productId: `gid://shopify/Product/${productId}` } },
);

This results in the following:

Unexpected Server Error

Error: Received an error response (403 Forbidden) from Shopify:
[
  {
    "message": "",
    "extensions": {
      "code": "ACCESS_DENIED"
    }
  }
]
If you report this error, please include this id: 2a801ad4-af19-4179-916b-85bb43ef5057

I can’t seem to work out why this works in one store, and not another.

Are there any Staff members that can help me diagnose what the issue is? I tried chat support, but they’ve directed me here.

Many thanks

2

Hi Jahilldev,

A 403 Forbidden error typically means that the app doesn’t have the necessary permissions to access the requested resource. Here are a couple things you could check:

  1. Access Scopes: Make sure your app has the necessary access scopes to access the requested resource. You can check the access scopes your app has on the store by going to the apps section on the Shopify admin dashboard. Make sure your app has access to read products.

  2. Storefront API Access: Check if your app has enabled the Storefront API access. You can do this by going to the app setup in your Shopify Partners dashboard, under the ‘App setup’ section, check if ‘Allow this app to access your storefront data using Storefront API’ is checked.

  3. Storefront API Token: Make sure you’re using the correct Storefront API token. If you’re using an incorrect or expired token, it might lead to a 403 error.

  4. Product ID: Make sure the product ID you’re using in your query is correct and exists in the store. If the product does not exist or your app does not have access to it, it might result in a 403 error.

Try the above steps and let us know if you’re still seeing issues. Hope this helps!

3

Hi Liam,

Thanks for getting back to me. I’ve double checked the scopes specified in the staging app match the production scopes, so that’s aligned.

Storefront API access is also enabled for both apps.

The Storefront token is getting acquired from the Session table in Shopify’s remix framework, the same as production. I believe this is generated on install within a store, I’ve tried uninstalling / re-installing, but no luck.

The productId is correct for the staging store, double checked to certain.

Are there any other suggestions, or are you able to somehow lookup the “id” posted in my original post to find out exactly why I’m receiving a 403?

Really appreciate the help!

Thanks

4

Okay, so for future me (or anyone else experiencing this), the issue here for us was as follows;

Check your user permissions in the store you wish to install the app into; I was a “Staff” user, with restricted levels of permission. By changing this to make me a “Contributor”, with relevant user permissions to manage apps, the 403’s became 200’s.

I’m guessing that due to it being my account that was installing the app, Shopify was denying the app access to the storefront API based on my level of user permissions, not the scopes defined in the app.

I’d really like this to be added to the documentation, if it doesn’t already exist. This took a little while to get to the bottom of. If the documentation already exists, it’s probably not accessible, or detailed enough to have caught my eye.

I’d really like a member of Shopify’s staff to weigh in on this, and perhaps detail how the app permissions are tied to the installer’s account permissions. That seems kind of odd..

Anyway, fixed for us, and hopefully this helps someone else in the future.