vtex-io-auth-tokens-and-context

To choose the correct VTEX IO auth token, identify the requester context (storefront, Admin, or background app) and select AUTH_TOKEN, STORE_TOKEN, or ADMIN_TOKEN to match the required permissions. This ensures proper token propagation through IO clients.

AUTH_TOKEN, STORE_TOKEN, and ADMIN_TOKEN represent different VTEX IO authentication identities. STORE_TOKEN applies to storefront contexts, ADMIN_TOKEN to Admin environments, and AUTH_TOKEN generally handles background app workflows, ensuring the identity matches the requester's permissions.

Propagate VTEX IO tokens by explicitly using the authMethod when passing tokens to IO clients. This guarantees the correct identity is attached to each call without exposing credentials in client-side code.

You should use an explicit authMethod with VTEX IO client calls when you need to guarantee the correct token identity is applied for each specific call. This enforces the proper permission scope consistently across backend requests.

Yes, VTEX IO token selection differs by context. Background app workflows typically require AUTH_TOKEN, while storefront requests use STORE_TOKEN. Selecting the token based on the requester context ensures the correct permission scope is enforced.

VTEX IO client calls fail with permission errors when the selected token identity does not match the requester context. Applying token selection consistently between AUTH_TOKEN, STORE_TOKEN, and ADMIN_TOKEN resolves these permission scope mismatches.