Remember all that talk about simplifying metafield access on Shopify? Well, the future is officially here, and it brings a significant shift for how your apps interact with metafields and metaobjects. As of May 19, 2025, public access for app-owned metafields and metaobjects through the Admin GraphQL API has been disabled.
This isn't a drill, folks! If your custom app relies on other applications being able to read or write to your app-owned metafields and metaobjects, you've got some crucial steps to take.
In a nutshell, Shopify has tightened the reins on data access for app-owned metafields and metaobjects. Here's the breakdown of the changes across all API versions:
PUBLIC_READ_WRITE
, Hello MERCHANT_READ_WRITE
: Any metafields or metaobjects you previously set to PUBLIC_READ_WRITE
are now automatically configured as MERCHANT_READ_WRITE
. This means they are still accessible to the merchant and their storefront, but not to other apps by default.
PUBLIC_READ
Becomes MERCHANT_READ
: Similarly, if your metafields or metaobjects were PUBLIC_READ
, they are now MERCHANT_READ
. The same principle applies – accessible to the merchant and storefront, but not publicly to other apps.This move is all about enhancing security and simplifying data access management within the Shopify ecosystem. By restricting public access to app-owned metafields and metaobjects, Shopify is ensuring that data remains within the intended scope of your app and the merchant. It encourages more intentional and secure data sharing practices.
This is where you come in! If your app's functionality depends on other applications being able to access the metafields or metaobjects that your app owns, you must migrate them.
The key is to understand the difference between a reserved namespace and a custom namespace:
In simpler terms: If you want other apps to see or modify your app's data, don't keep it in your app's "private" reserved attic. Move it to a "shared" custom room!
Identify Affected Metafields/Metaobjects: Go through your app's code and identify any metafields or metaobjects that were previously set to PUBLIC_READ_WRITE
or PUBLIC_READ
and are intended for access by other applications.
Migrate to a Custom Namespace: For these identified metafields and metaobjects, you will need to:
my_app_shared_data
).
Define Access: Once in a custom namespace, you can then configure the appropriate access settings (e.g., READ_WRITE
, READ
) for other applications as needed.
You can find more details about the update from Shopify here:
https://shopify.dev/changelog/public-access-for-app-owned-metafields-and-metaobjects-is-now-disabled
While the change officially happened on May 19, 2025, proactive migration is crucial to avoid any disruptions to your app's functionality or your users' experience. This is a positive step towards a more secure and streamlined Shopify ecosystem, but it requires your attention.
Make sure to reach out to the developers of any third party apps your store is using that might be affected!
Are you're a startup looking to establish a solid online presence or simply want to extend upon your Shopify store? Partner up with Weblayer! Our background in developing high-quality, fully responsive, and highly user-friendly e-commerce experiences will ensure that your business flourishes. Let's have a chat and discuss how we can help your business grow.
In our blogs we dive into topics like web design, development, and discoverability. Learn about best practices for your website and tips to help you with the success of your business upon launch.