# Shopify identity

> How signed-in Shopify customers are recognised through the App Proxy, the popup fallback, and the 60-day order history limit.

Source: https://shopassist.coec.dk/docs/orders-and-identity/shopify · Updated 2026-10-01

## App Proxy [#app-proxy]

When a signed-in customer opens the chat, the widget calls `/apps/shopassist/identity` on your store domain. Shopify signs the request and adds the customer id; ShopAssist verifies the signature and issues a token valid for at most 10 minutes. No setup is needed.

If you changed the app proxy prefix or subpath under **Settings → Apps → ShopAssist**, set the same path in the theme editor under **App embeds → AI chat assistant → App proxy path**. The app warns you when they differ.

## Known Shopify issue with new customer accounts [#new-customer-accounts]

With new customer accounts, Shopify sometimes doesn't pass the customer id to app proxies. The widget then retries once and offers:

* **Verify it's you**: a Shopify sign-in popup (Customer Account API) that returns a token to the widget;
* or the [email code](/docs/orders-and-identity/email-verification) for one order.

The popup needs your storefront domain to serve Shopify's customer account configuration; stores where it doesn't use the email code only.

## Order history [#history]

Shopify gives apps the last 60 days of orders until it approves access to all orders. The dashboard shows "Last 60 days of orders until Shopify approves full history" meanwhile.

## Actions [#actions]

Cancellations need the optional `write_orders` permission and returns `read_returns`/`write_returns`; grant them from the app when you switch these features on.