---
updatedAt: 2026-08-12T06:49:53.000Z
agentTools:
  projectIndex: https://developer.loopwork.co/llms.txt
---

# Overview

## Authentication

The storefront API uses JWT tokens(`access token`) to authenticate requests. You can get the access token using either your `API key` or using a `session token`.

Your API keys carry many privileges, so be sure to keep them secure. Don't share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.

A customer will always land on the portal using a `session token`. They can receive this token via multiple flows like email notifications, generating a magic link, reactivation campaigns etc.

The following diagram shows how we can utilise the `session token` to get access to the portal.

<Image src="https://files.readme.io/0f570474cf729d65314aa5975ea3a1cb21dc90a9e7872a92c257452a6040d494-image.png" align="center" caption="Storefront authentication flow" />

### Tokens

* **Session token** - Entry token, expiry - 1 day
* **Access token** - Auth token for every storefront API, expiry - 4 days
* **Refresh token** - Used to rotate `access token`, expiry - 30 days

A `session token` is used to get a `refresh token` and `access token` in a single API call. This is to save one API call per new login. Afterwards, the refresh token can be used to rotate the `access token` which will generate a fresh `access token`.

The `access token` can be used as a bearer token in the headers for authentication

***

## Login with Shopify customer account

**Endpoint:**<br />`POST /a/loop_subscriptions/storefront/auth/accessToken`

**Description:**<br />This endpoint validates the Shopify customer session and returns a Loop access token if the customer is authenticated.

**Behavior:**

* Returns `401 Unauthorized` if:

  * The customer is not logged into their Shopify account.
  * The customer does not exist in the Loop.
* On success, returns an `accessToken` in the response payload.

**Response Example (200 OK):**

```json
{
    "success": true,
    "message": "Access token generated successfully",
    "data": {
        "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyVHlwZSI6IkNVU1RPTUVSIiwidXNlcklkIjo2Mjg2NzE5NywidXNlclNob3BpZnlJZCI6NzMwMjg0MzMzNDgyOSwic3RvcmVJZCI6ODE2MiwibXlzaG9waWZ5RG9tYWluIjoiYmVjYXVzZW1hcmtldC1wcmdhasdkjn2jdkhqdsajhjkd1klxhdndkndasXh0IjpudWxsLCJpYXQiOjE3NDg5NTE3OTgsImV4cCI6MTc0OTI5NzM5OH0.cWxEG00rYhhU3jEA3Xrh9DEUQiXYzRQ07ThwypVd7ZM"
    }
}
```

**Response Example (401 Unauthorized):**

```json
{
  "success":false,
  "message":"Unauthorized",
  "data":{}
}
```

**Usage:**<br />Use the returned `accessToken` to authenticate requests to the Loop Storefront API.

**Note:** This endpoint only works on the Shopify storefront.