From saleor-commerce
Configures Saleor security: JWT/refresh tokens, OIDC integration, App tokens/permissions, rate limiting, CORS, headers. Use for auth flows and production hardening.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin saleor-commerceThis skill is limited to using the following tools:
**Fetch live docs**:
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Searches prompts.chat for AI prompt templates by keyword or category, retrieves by ID with variable handling, and improves prompts via AI. Use for discovering or enhancing prompts.
Guides MCP server integration in Claude Code plugins via .mcp.json or plugin.json configs for stdio, SSE, HTTP types, enabling external services as tools.
Fetch live docs:
site:docs.saleor.io authentication JWT tokens for current JWT authentication flowsite:docs.saleor.io apps permissions for App token authentication and permission modelsite:docs.saleor.io OIDC OpenID Connect for OIDC integration configurationsaleor webhook payload signature JWS verification for webhook signature verificationhttps://docs.saleor.io/docs/developer/app-store/apps/overview for App authentication patternssaleor CORS security headers production for CORS and header configurationSaleor uses JSON Web Tokens for staff and customer authentication. Tokens are obtained via GraphQL mutations and passed as Bearer tokens.
| Operation | GraphQL Mutation | Token Type | Expiry |
|---|---|---|---|
| Customer login | tokenCreate | Access + Refresh | Access: 5 min, Refresh: 30 days |
| Staff login | tokenCreate | Access + Refresh | Access: 5 min, Refresh: 30 days |
| Refresh | tokenRefresh | New access token | 5 min (configurable) |
| Verify | tokenVerify | Validity check | N/A |
| Deactivate | tokensDeactivateAll | Invalidate all | N/A |
Authorization: Bearer <token> headerSaleor supports OpenID Connect for federated authentication. Saleor acts as an OAuth client, delegating login to an external identity provider.
| Mode | Description | Use Case |
|---|---|---|
| Saleor as OAuth client | Delegates login to external IdP | SSO with corporate directory |
| Authorization Code flow | Standard OIDC flow with code exchange | Web applications |
| ID token login | Accept ID token from external IdP | Mobile or SPA apps |
OIDC_JWKS_URL — JSON Web Key Set endpoint of the IdPOIDC_OAUTH_CLIENT_ID — Client ID registered with IdPOIDC_OAUTH_CLIENT_SECRET — Client secret for code exchangeApps authenticate using App tokens (permanent Bearer tokens) rather than JWT:
| Token Type | Obtained Via | Expiry | Scope |
|---|---|---|---|
| App token | appTokenCreate mutation | Never (manual revoke) | App's declared permissions |
| Auth token (install handshake) | Token exchange during install | Session-scoped | Full App permissions |
Saleor uses a granular permission system applied to staff users, permission groups, and Apps.
| Permission | Grants Access To |
|---|---|
MANAGE_PRODUCTS | Create, update, delete products, variants, types |
MANAGE_ORDERS | View and modify orders, fulfillments, returns |
MANAGE_APPS | Install, configure, and remove Apps |
MANAGE_USERS | Manage customer accounts |
MANAGE_STAFF | Manage staff users and permission groups |
MANAGE_CHECKOUTS | Access and modify checkouts |
MANAGE_CHANNELS | Create and configure channels |
MANAGE_SHIPPING | Configure shipping zones and methods |
MANAGE_DISCOUNTS | Manage promotions, vouchers, gift cards |
MANAGE_TRANSLATIONS | Manage translations for all entities |
MANAGE_SETTINGS | Access to site-wide settings |
MANAGE_PAGE_TYPES_AND_ATTRIBUTES | Manage page types and attribute schemas |
MANAGE_PRODUCT_TYPES_AND_ATTRIBUTES | Manage product types and attribute schemas |
HANDLE_PAYMENTS | Process transactions and refunds |
HANDLE_TAXES | Configure tax providers |
is_superuser) bypasses all permission checksTHROTTLE_CLASSES in Django settings| Setting | Description | Example |
|---|---|---|
ALLOWED_ORIGINS | Origins permitted to make requests | ["https://storefront.example.com"] |
ALLOWED_HOSTS | Hostnames the server responds to | ["api.example.com"] |
CORS_ALLOW_CREDENTIALS | Allow cookies cross-origin | true for Dashboard |
CORS_ALLOW_HEADERS | Additional allowed headers | ["authorization-bearer", "content-type"] |
django-cors-headers middleware (included in Saleor)CORS_ALLOW_ALL_ORIGINS = True in production| Header | Value | Purpose |
|---|---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains | Enforce HTTPS |
X-Content-Type-Options | nosniff | Prevent MIME-type sniffing |
X-Frame-Options | DENY or SAMEORIGIN | Prevent clickjacking |
Content-Security-Policy | Directive-based | Restrict resource loading |
Referrer-Policy | strict-origin-when-cross-origin | Limit referrer leakage |
SECRET_KEY, never in source codeSECURE_SSL_REDIRECT = True in Django settingsSECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") behind a reverse proxySESSION_COOKIE_SECURE = True and CSRF_COOKIE_SECURE = TrueSaleor signs every webhook with the Saleor-Signature header. Since 3.5+, the default is JWS (RS256) using a public key from /.well-known/jwks.json. Legacy HMAC-SHA256 (via App secret) is deprecated and will be removed in 4.0.
<saleor-domain>/.well-known/jwks.jsonsaleor-app-sdk built-in middleware for automatic verification| Item | Action |
|---|---|
| HTTPS | Enable SECURE_SSL_REDIRECT, set cookie secure flags |
| SECRET_KEY | Strong random value, environment variable only |
| ALLOWED_HOSTS | Restrict to actual domain names |
| CORS | Restrict to known origins |
| DEBUG | Set DEBUG = False in production |
| Database | Use SSL connections, restrict network access |
| App tokens | Rotate periodically, grant minimal permissions |
| Webhook signatures | Always verify JWS/HMAC on every webhook handler |
| Rate limiting | Enable throttling on all public endpoints |
| Dependencies | Pin versions, audit with pip-audit or safety |
| Admin access | Use permission groups with least-privilege |
| Logs | Never log tokens, secrets, or PII |
ALLOWED_HOSTS and CORS to prevent host header attacks and cross-origin abuseFetch the security documentation for current JWT authentication flow, OIDC configuration, and permission model before implementing.