diff --git a/packages/medusa-plugin-wishlist/package.json b/packages/medusa-plugin-wishlist/package.json
index f3dbe8f531..88d1e569a2 100644
--- a/packages/medusa-plugin-wishlist/package.json
+++ b/packages/medusa-plugin-wishlist/package.json
@@ -36,6 +36,7 @@
   },
   "dependencies": {
     "body-parser": "^1.19.0",
+    "cors": "^2.8.5",
     "express": "^4.17.1",
     "medusa-core-utils": "^1.1.20",
     "medusa-test-utils": "^1.1.23"
diff --git a/packages/medusa-plugin-wishlist/src/api/index.js b/packages/medusa-plugin-wishlist/src/api/index.js
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/packages/medusa-plugin-wishlist/src/api/store/customers.js b/packages/medusa-plugin-wishlist/src/api/store/customers.js
index a7000e6895..ee44fb6b36 100644
--- a/packages/medusa-plugin-wishlist/src/api/store/customers.js
+++ b/packages/medusa-plugin-wishlist/src/api/store/customers.js
@@ -1,6 +1,9 @@
 import { Router } from "express"
 import bodyParser from "body-parser"
 import { Validator, MedusaError } from "medusa-core-utils"
+import jwt from "jsonwebtoken"
+
+const JWT_SECRET = process.env.JWT_SECRET || ""
 
 export default () => {
   const app = Router()
@@ -74,5 +77,34 @@ export default () => {
     }
   })
 
+  app.post("/:id/wishlist/share-token", bodyParser.json(), async (req, res) => {
+    try {
+      const customerService = req.scope.resolve("customerService")
+
+      let customer = await customerService.retrieve(req.params.id)
+
+      // check customer exists else throw 404
+      if (!customer?.id) {
+        throw new MedusaError(Medusa.Types.NOT_FOUND, "not found", 404)
+      }
+
+      // check customer has wishlist else throw 400 bad request
+      if (!customer?.metadata?.wishlist) {
+        throw new MedusaError(Medusa.Types.INVALID_DATA, "invalid data", 400)
+      }
+
+      const token = jwt.sign(
+        {
+          customer_id: customer.id,
+        },
+        JWT_SECRET
+      )
+
+      res.json({ share_token: token })
+    } catch (err) {
+      throw err
+    }
+  })
+
   return app
 }
diff --git a/packages/medusa-plugin-wishlist/src/api/store/index.js b/packages/medusa-plugin-wishlist/src/api/store/index.js
new file mode 100644
index 0000000000..ef5a12687d
--- /dev/null
+++ b/packages/medusa-plugin-wishlist/src/api/store/index.js
@@ -0,0 +1,36 @@
+import { Router } from "express"
+import jwt from "jsonwebtoken"
+import cors from "cors"
+import { getConfigFile } from "medusa-core-utils"
+
+export default () => {
+  const app = Router()
+
+  const JWT_SECRET = process.env.JWT_SECRET || ""
+
+  // const { configModule } = getConfigFile(rootDirectory, "medusa-config")
+  // const { projectConfig } = configModule
+
+  // const corsOptions = {
+  //   origin: projectConfig.store_cors.split(","),
+  //   credentials: true,
+  // }
+  // console.log(corsOptions)
+  // app.options("/wishlists/:token", cors(corsOptions))
+  app.get("/wishlists/:token", async (req, res) => {
+    const { token } = req.params
+
+    // decorde token with decode = jwt.decode(token, secret)
+    const decode = jwt.decode(token, JWT_SECRET)
+    console.log(decode)
+    // fetch customer.retrieve(decode.customer_id)
+    // get customer.metadata.wishlist
+
+    // respond with
+    // wishlist
+    // first_name
+    res.json("200")
+  })
+
+  return app
+}
diff --git a/packages/medusa-plugin-wishlist/yarn.lock b/packages/medusa-plugin-wishlist/yarn.lock
index f00a7f9a14..9511ed85a1 100644
--- a/packages/medusa-plugin-wishlist/yarn.lock
+++ b/packages/medusa-plugin-wishlist/yarn.lock
@@ -1816,6 +1816,14 @@ core-util-is@1.0.2, core-util-is@~1.0.0:
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
   integrity sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=
 
+cors@^2.8.5:
+  version "2.8.5"
+  resolved "https://registry.yarnpkg.com/cors/-/cors-2.8.5.tgz#eac11da51592dd86b9f06f6e7ac293b3df875d29"
+  integrity sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==
+  dependencies:
+    object-assign "^4"
+    vary "^1"
+
 cross-env@^5.2.1:
   version "5.2.1"
   resolved "https://registry.yarnpkg.com/cross-env/-/cross-env-5.2.1.tgz#b2c76c1ca7add66dc874d11798466094f551b34d"
@@ -3951,6 +3959,11 @@ oauth-sign@~0.9.0:
   resolved "https://registry.yarnpkg.com/oauth-sign/-/oauth-sign-0.9.0.tgz#47a7b016baa68b5fa0ecf3dee08a85c679ac6455"
   integrity sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==
 
+object-assign@^4:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/object-assign/-/object-assign-4.1.1.tgz#2109adc7965887cfc05cbbd442cac8bfbb360863"
+  integrity sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM=
+
 object-copy@^0.1.0:
   version "0.1.0"
   resolved "https://registry.yarnpkg.com/object-copy/-/object-copy-0.1.0.tgz#7e7d858b781bd7c991a41ba975ed3812754e998c"
@@ -5266,7 +5279,7 @@ validate-npm-package-license@^3.0.1:
     spdx-correct "^3.0.0"
     spdx-expression-parse "^3.0.0"
 
-vary@~1.1.2:
+vary@^1, vary@~1.1.2:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/vary/-/vary-1.1.2.tgz#2299f02c6ded30d4a5961b0b9f74524a18f634fc"
   integrity sha1-IpnwLG3tMNSllhsLn3RSShj2NPw=