Is it secure to store API keys on the customer with unauthenticated_read_customers?

Shopify / storefront-api-examples

Example custom storefront applications built on Shopify's Storefront API

https://help.shopify.com/api/storefront-api

MIT License

1.12k stars 329 forks source link

Is it secure to store API keys on the customer with unauthenticated_read_customers? #167

Open achadee opened 3 years ago

achadee commented 3 years ago

Hi there,

We have an API that we want to integrate with our shopify customers. As far as I can see it is secure to store the metafields, because to access the metafields you need to provide a shopify customer access token.

Can you confirm if there are any security vulnerabilities.

thanks .