identify-forbidden

https://docs.getenvie.com/errors/identify-forbidden · 403 — a public-mode caller tried to attach a customer identity.

A public key ships in browser code, so anyone can use it. If it could assert "I am customer 42", anyone could read any customer's wishlist. It can't — by design, always.

Fix

Call identify() from your server with a secret key, after your own login flow has authenticated the customer:

import { createEnvie } from "@getenvie/client";

const envie = createEnvie({
	mode: "private",
	shop: "your-store.myshopify.com",
	secretKey: process.env.ENVIE_SECRET_KEY!,
	anonymousId, // sent up from the browser
});

await envie.identify({ customerId });

The guest → customer merge guide covers the full flow.

On Liquid storefronts this never comes up: the app proxy tells us who's logged in, verified by Shopify, and the merge is automatic.