> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Querying From External Systems

Plan: Developer Foundations

Lesson 8 of 28 · 15 min

If you wish to use the GraphQL Storefront API from an external system, such as a headless storefront, there are a few considerations:

* In which Channel do you wish to run requests?
* Are you running requests from a server or a front-end application/browser?
* Does a request require the context of a customer, or does it deal only with anonymous information?

### I want to run requests in the context of the store's default channel (Channel ID 1)

There are three options for public URLs that you can use to run requests:

* The store's default storefront URL, e.g. `https://store.com/graphql`
* The store's canonical URL, e.g. `https://store-STOREHASH.mybigcommerce.com/graphql`
* The store's custom checkout domain

### I want to run requests from the perspective of another Channel

In this case, you should use the Channel's Permanent URL of the form `https://store-STOREHASH-CHANNELID.mybigcommerce.com/graphql.` In order for the Channel's Permanent URL to be available, you must create a Site for the channel.

For example, if your store hash is `abc123` and your channel ID is `456`, the correct URL would be `https://store-abc123-456.mybigcommerce.com/graphql`. Note that you must create your Storefront API Token with the same channel ID, or your request will be rejected.

### I want to run requests from a browser (e.g. React app)

In this case, use a standard Storefront API Token with the proper allowed origins set. Session cookies will provide customer context when it exists.

> **Info**
>
> This is the same use case as the Vanilla JS + Bootstrap example.

### I want to run requests from a server and I don't need a customer context

In this case, use a **Private Token** without sending a `X-Bc-Customer-Access-Token` header.

> **Info**
>
> Using a Private Token for server-side requests is a recent change to the BigCommerce GraphQL Storefront API. If you have existing integrations using standard Storefront Tokens for server-to-server requests, see the [Authentication documentation](/developer/docs/storefront/guides/graphql-storefront-api/authentication) for migration details.

### I want to run requests from a server and the customer context matters

In this case, use a **Private Token** and provide a customer access token in the `X-Bc-Customer-Access-Token` header.

When server-side requests are made from an application like a headless storefront, the required GraphQL Storefront interactions are often extensive and varied. A request for store settings, for example, may require no customer context. The majority of other requests likely do need a customer context if it exists; queries for catalog data may be affected by customer pricing or visibility, and cart and checkout operations are customer-specific. It's common to simply provide a customer access token (if it exists) for all requests. If you instead choose to selectively include a customer access token for some requests and not others, make sure you carefully consider which requests are affected (or might be in the future) by customer context.

## Resources

* [Querying from External Systems](/developer/docs/storefront/guides/graphql-storefront-api#faq)
* [GraphQL Storefront API - Authentication](/developer/docs/storefront/guides/graphql-storefront-api/authentication)
* [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
* [Sites and Routes](/developer/api-reference/rest/admin/management/sites)
* [List of GraphQL Error Messages](/developer/api-reference/rest/overview)