Deprecated API calls wrongly attributed to our app because third parties are reusing our public storefront access token

Hydrogen and Storefront APIs
1

We received an API deprecation warning for our app (with delisting threatened after October 1, 2026) for Storefront API calls our app doesn’t make.

What happened

Our API health report flagged CartDiscountCodesUpdate.discountCodes. We audited our codebase and deployed extension bundles: we removed all usage of cartDiscountCodesUpdate months ago, and every call we make is pinned to API version 2026-04.

After support shared the affected shop domains, we traced the calls to a third-party integration script. Merchants had copy-pasted our app’s public storefront access token into that integration’s configuration, and all of its traffic was attributed to our app.

The problem

Public storefront tokens are public by design. The docs explicitly describe embedding them in browsers, and any cart app querying the Storefront API client-side must render its token into the page. But that means any script on the page can lift the token and use it, and every call it makes lands on the token owner’s API health report. So an app can face delisting warnings for traffic it has no control over and no way to trace without a support ticket.

Questions

  1. Is there any way for an app or merchant to check which app owns a given storefront access token? shop.storefrontAccessTokens only returns the requesting app’s own tokens, and the Storefront API has no token introspection as far as we can tell. If ownership were verifiable, integrations could refuse tokens belonging to another app.
  2. Could the API health report include request metadata (origin, user-agent, or a per-shop breakdown) for flagged calls, so token owners can find third-party usage themselves?
  3. Could deprecation enforcement distinguish first-party from third-party traffic on a public token before penalizing the app that owns it?
2

Duplicate of Deprecated cartDiscountCodesUpdate (missing discountCodes) attributed to our app — but our code never calls it. How to identify the source store?

3

Same here,

Our own Storefront API client is pinned to version 2026-04 and makes queries only (product/config reads) - it never calls the cartDiscountCodesUpdate mutation anywhere in our codebase.

I think the reason these calls are attributed to us is structural: our app publishes a public-read Storefront access token in the shop’s page source so our widget can read product data. Shopify attributes every Storefront API call to the app that created the token, not to the script that actually fires it.

Any third-party integration on the store (page builders, email/CRM tools, mobile app wrappers, custom theme code) can pick up that publicly-readable token and make its own calls - and those then show up in our deprecation report.