> For the complete documentation index, see [llms.txt](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/notify-me-and-coming-soon/widget-authentication.md).

# Widget authentication

The Notify Me and Coming Soon widget must authenticate its API requests to TWC. This authenticates the retailer integration and is separate from customer login.

For Shopify, the recommended approach is Shopify app proxy authentication. The proxy validates Shopify's signed request and uses the retailer's configured TWC API authentication to return a tenant-scoped token. This works for guest shoppers and logged-in customers.

| Method            | Configuration       | Use                                                                                       |
| ----------------- | ------------------- | ----------------------------------------------------------------------------------------- |
| Shopify app proxy | `data-auth="proxy"` | Recommended for Shopify storefronts, including guest registration.                        |
| TWC widget token  | `data-auth="token"` | Alternative where TWC has supplied and approved a browser/storefront token configuration. |

For custom implementations on other platforms, use REST API bearer-token authentication through your backend or integration service. See API Custom Implementations.

## Token authentication

Token mode is the default:

```html
<button
  id="popup-open"
  data-type="notify-me"
  data-auth="token"
  data-tenant="your-tenant">
  Notify Me
</button>
```

The widget uses a TWC-issued storefront token when making Customer Interest API requests.

### Security guidance

{% hint style="warning" %}
A storefront widget runs in the customer browser. Do not place privileged Shopify Admin credentials, private server tokens or other secrets in widget configuration or theme code.

Use only the browser/storefront credential and tenant configuration supplied for the TWC integration.
{% endhint %}

## Shopify App Proxy authentication

The widget requests a tenant-scoped TWC access token from `/apps/<proxy-app>/auth/token`. With the default proxy path, this is `/apps/twc-sdk/auth/token`.

The token represents the retailer's TWC API context. Obtaining it does not sign the shopper in or prove ownership of an email address entered into the widget.

## Customer login and identification

Notify Me and Coming Soon registration does not require customer login. A guest can enter contact details and request an alert. If the submitted email matches a customer within the retailer's TWC tenant, the notification is associated with that record.

Customer login and appropriate authorisation are required for access to existing customer information or account management. These requirements are separate from the authentication used to submit an alert request.

Choose authentication according to the integration platform and configured credentials. Do not switch to token mode simply because the shopper is logged out.

## Recommendations and failures

If the proxy token cannot be obtained, the widget cannot make the authenticated TWC request. Treat this as an authentication or integration failure; do not assume the shopper needs to log in.

Recommendations do not inherently require Shopify customer login. Where recommendations require an email, it can come from available customer context or the submitted form.  An email-based recommendation lookup does not authenticate the shopper.&#x20;

Shop Similar Styles recommendations use the same widget authentication context for calls to TWC.

See [Product Recommendations & Integrations](broken://pages/ea38528eb92781511938bb60da9abf7467ca0596) for recommendation-specific configuration.