Shopify · sdk · fg-0327
Custom session token verification fails with 'jwt not active' or 'jwt expired' in an embedded Shopify app
InvalidJwtError: Failed to parse session token
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
Session tokens live for one minute and carry an nbf claim, so a server clock a few seconds behind rejects them and cached tokens expire quickly. The official library allows 10 seconds of clock skew, while hand-rolled jwt.verify calls allow none.
Fix
Fetch a fresh token with shopify.idToken() for every request, keep server time synced, and pass a small clock tolerance when verifying yourself.
Apply
// client
const token = await shopify.idToken()
// server, jose
await jwtVerify(token, key, { algorithms: ['HS256'], clockTolerance: 10, audience: process.env.SHOPIFY_API_KEY })Affects: Embedded Shopify apps using App Bridge session tokens; @shopify/shopify-api tolerates 10 s, custom verifiers often 0
Sources
- https://shopify.dev/docs/apps/build/authentication-authorization/session-tokens
- https://github.com/Shopify/shopify-api-js/issues/137
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp