1. Home
2. Changelog
3. Store admin in session tokens and launch URLs

Store admin in session tokens and launch URLs

Last updated Oct 24, 2026 View as Markdown

• The iss claim of a session token is the store admin URL, https://<slug>.youcan.store/admin, instead of https://seller-area.youcan.shop/admin.
• The dest claim is the store's YouCan URL, https://<slug>.youcan.store, with the scheme. A custom domain of the store is never used in iss or dest.
• Check that iss is dest followed by /admin.
• The launch URL of an embedded app has a host param with the base64-encoded store admin (<slug>.youcan.store/admin). The host param is included in the HMAC.
• When your app is loaded outside the Seller Area, redirect to https://<decoded host>/apps/<your app handle>/app.
• See JWT Payload.