App proxy endpoints

Oxify registers a Shopify app proxy. Requests to /apps/oxify-cart-api/* on your storefront domain are forwarded by Shopify to the Oxify app server.

Proxy settings

• Prefix: apps
• Subpath: oxify-cart-api
• Storefront URL pattern: /apps/oxify-cart-api/ followed by the endpoint name

What "proxied" means

The browser calls a URL on your storefront domain. Shopify forwards it to the Oxify backend and adds signed query parameters, including shop and signature. Oxify checks the signature before doing anything: a request without a valid signature gets a 403 response, and one without a shop gets a 400.

Endpoints

There is one endpoint, and it exists for the cart drawer's own analytics:

• POST /apps/oxify-cart-api/analytics-v2-impressions — Receives analytics events in batches. The JSON body is { "events": [...] }, where each event has sessionId, eventType, an optional metadata object and an optional timestamp. The accepted event types are oxify_cart_open, oxify_checkout_click, oxify_discount_applied, oxify_fbt_offer_shown and oxify_fbt_product_added; events with any other type are skipped. The response is { "ok": true, "saved": n, "total": n, "breakdown": { "cart": n, "fbt": n } }.

A signed GET to any path under /apps/oxify-cart-api/ returns { "ok": true, "shop": ..., "endpoint": ... } as a health check. A POST to any other path returns 404 with { "ok": false, "error": "Unknown endpoint" }.

Not a general-purpose API

The cart drawer's script calls this endpoint by itself, so you don't need to call it. There are no proxy endpoints for reading cart state, reward eligibility or post-purchase funnels. To read the cart on the storefront, use Shopify's own /cart.js; to control the drawer from your theme, use the JavaScript methods in the Developer Documentation.

Authentication

Shopify adds the signature parameters automatically when a request goes through your storefront domain, so your fetch doesn't need to send credentials. Calls that don't carry a valid signature are rejected.