Client-App backend communication
Direct communication from the browser to the app backend involves generating a JWT token. This token contains session-specific information, as claims, and is securely signed by the shop. This mechanism ensures a secure exchange of data between the client and the app backend.
WARNING
The JWT key can be only generated when in the browser the user is logged-in.
The Flow
The JWT token
The JWT token contains the following claims:
languageId- the language ID of the current sessioncurrencyId- the currency ID of the current sessioncustomerId- the customer ID of the current sessioncountryId- the country ID of the current sessionsalesChannelId- the sales channel ID of the current session
The claims are only set when the app has permission to that specific entity like sales_channel:read for salesChannelId claim.
The JWT token is signed with SHA256-HMAC and the secret is the appSecret from the app registration and the issued by is the shopId also from the registration.
Generate JWT key
The JWT key is generated with a POST request against /store-api/app-system/{name}/generate-token or /app-system/{name}/generate-token.
INFO
Requesting from the browser to the app backend is only possible when your app backend allows CORS requests. Example:
- Access-Control-Allow-Origin: *
- Access-Control-Allow-Methods: GET, POST, OPTIONS
- Access-Control-Allow-Headers: shopware-app-shop-id, shopware-app-token
