Security model
Browser access
Section titled “Browser access”Shopify Liquid requests use Shopify App Proxy signatures. Hydrogen browsers use short-lived exact-origin storefront tokens exchanged by the merchant’s server. Retail customers use scoped interaction tokens. None of these browser paths expose Aabhas license keys or internal service credentials.
Media access
Section titled “Media access”Uploads and normal result reads use limited signed URLs. A signed URL grants temporary access to one operation or object; it is not a reusable account credential.
Administrative access
Section titled “Administrative access”Studio uses authenticated user sessions and role-aware organization authorization. Access is limited to the organizations and capabilities assigned to each user.
Integration credentials
Section titled “Integration credentials”Store license keys and Hydrogen installation credentials in a secret manager. Rotate or revoke them through the supported control surface. Do not place them in public environment variables, browser bundles, logs, analytics, screenshots, or support tickets.