Session Management

interface Session {
  id: string;                    // Unique session identifier
  shop: string;                  // Shop domain (e.g., example.myshopify.com)
  state: string;                 // OAuth state parameter
  isOnline: boolean;            // Online (user) vs offline (shop) token
  scope?: string;               // Granted API scopes
  accessToken?: string;         // Access token for API requests
  expires?: Date;               // Token expiration (online tokens only)
  refreshToken?: string;        // Refresh token (if expiring tokens enabled)
  refreshTokenExpires?: Date;   // Refresh token expiration
  onlineAccessInfo?: {          // User info (online tokens only)
    associated_user: {
      id: number;
      first_name: string;
      last_name: string;
      email: string;
      account_owner: boolean;
      locale: string;
      collaborator: boolean;
      email_verified: boolean;
    };
  };
}

const {session} = await shopify.auth.callback({
  rawRequest: req,
  rawResponse: res,
});

// Session is now ready to use
console.log(session.id);          // 'offline_example.myshopify.com'
console.log(session.shop);        // 'example.myshopify.com'
console.log(session.accessToken); // 'shpat_xxxxx'

import {Session} from '@shopify/shopify-api';

const session = new Session({
  id: 'offline_example.myshopify.com',
  shop: 'example.myshopify.com',
  state: 'state-value',
  isOnline: false,
  accessToken: 'shpat_xxxxx',
  scope: 'read_products,write_orders',
});

import {shopifyApi} from '@shopify/shopify-api';
import {MemorySessionStorage} from '@shopify/shopify-app-session-storage-memory';

const shopify = shopifyApi({
  // ... other config
  sessionStorage: new MemorySessionStorage(),
});

app.get('/auth/callback', async (req, res) => {
  const {session} = await shopify.auth.callback({
    rawRequest: req,
    rawResponse: res,
  });

  // Store the session
  await shopify.config.sessionStorage.storeSession(session);
  
  res.redirect(`/?shop=${session.shop}`);
});

const sessionId = 'offline_example.myshopify.com';
const session = await shopify.config.sessionStorage.loadSession(sessionId);

if (!session) {
  throw new Error('Session not found');
}

// Offline session ID
const offlineId = `offline_${shop}`;

// Online session ID
const onlineId = `${shop}_${userId}`;

const session = await shopify.config.sessionStorage.loadSession(sessionId);

if (!session.isActive(shopify.config.scopes)) {
  // Session is invalid - re-authenticate
  return res.redirect('/auth');
}

// Session is valid, proceed

if (session.isExpired()) {
  console.log('Session is expired');
  // Refresh or re-authenticate
}

const hasScope = session.isScopeIncluded('write_products');

if (!hasScope) {
  console.log('Session missing required scope');
  // Re-authenticate with new scopes
}

// In APP_UNINSTALLED webhook handler
shopify.webhooks.addHandlers({
  APP_UNINSTALLED: {
    deliveryMethod: DeliveryMethod.Http,
    callbackUrl: '/webhooks/app-uninstalled',
    callback: async (topic, shop, body) => {
      const sessionId = `offline_${shop}`;
      await shopify.config.sessionStorage.deleteSession(sessionId);
      console.log(`Deleted session for ${shop}`);
    },
  },
});

const sessionData = session.toObject();

console.log(sessionData);
// {
//   id: 'offline_example.myshopify.com',
//   shop: 'example.myshopify.com',
//   state: 'state',
//   isOnline: false,
//   scope: 'read_products',
//   accessToken: 'shpat_xxxxx'
// }

const properties = session.toPropertyArray();

console.log(properties);
// [
//   ['id', 'offline_example.myshopify.com'],
//   ['shop', 'example.myshopify.com'],
//   ['isOnline', false],
//   ['accessToken', 'shpat_xxxxx'],
//   // ...
// ]

const entries = [
  ['id', 'offline_example.myshopify.com'],
  ['shop', 'example.myshopify.com'],
  ['isOnline', false],
  ['accessToken', 'shpat_xxxxx'],
];

const session = Session.fromPropertyArray(entries);

const session1 = await shopify.config.sessionStorage.loadSession(id1);
const session2 = await shopify.config.sessionStorage.loadSession(id2);

if (session1.equals(session2)) {
  console.log('Sessions are identical');
}

const sessionToken = req.headers['authorization']?.replace('Bearer ', '');

const payload = await shopify.session.decodeSessionToken(sessionToken);

console.log('Shop:', payload.dest);
console.log('User ID:', payload.sub);

import {InvalidSession, SessionStorageError} from '@shopify/shopify-api';

try {
  const session = await shopify.config.sessionStorage.loadSession(id);
} catch (error) {
  if (error instanceof SessionStorageError) {
    console.error('Storage error:', error.message);
  } else if (error instanceof InvalidSession) {
    console.error('Invalid session data:', error.message);
  }
}