We received an API deprecation warning for our app (with delisting threatened after October 1, 2026) for Storefront API calls our app doesn’t make. What happened Our API health report flagged CartDiscountCodesUpdate.discountCodes. We audited our codebase and deployed extension bundles: we removed …

Same here, Our own Storefront API client is pinned to version 2026-04 and makes queries only (product/config reads) - it never calls the cartDiscountCodesUpdate mutation anywhere in our codebase. I think the reason these calls are attributed to us is structural: our app publishes a public-read Sto…

We’re facing the same issue. I think in general though it seems odd that these third party’s are just picking up tokens from the page and using them. Given that there was a possible threat of de-listing due to them making deprecated calls, I was thinking that the simple solution was to obfuscate th…

Hey — I came across your post about getting a deprecation warning for Storefront API calls your app doesn’t make, with the discountCodes field flagged even though you’d removed that usage months ago and pinned everything to 2026-04. I’m researching how Shopify developers debug these cases, so I’m c…

One partial mitigation that actually does something (unlike reversing/obfuscating the string, which is still visible over the wire): rotate the public token with storefrontAccessTokenCreate and delete the old one with storefrontAccessTokenDelete. Any copy sitting in a merchant’s third-party script g…

Hey folks - thanks for the reports here. We’ve confirmed a detection bug affecting CartDiscountCodesUpdate.discountCodes warnings. Calls served on Storefront API versions before 2026-01 can trigger the warning even when they correctly supply discountCodes, including []. This could be the reason for…

[image] Wes-Dev-Shopify: API Health doesn’t currently provide a self-serve breakdown of the originating store or third-party caller, and Support can’t disclose those stores’ identities. I’ve submitted a feature request for additional attribution tooling as well. @Wes-Dev-Shopify What is this …

Hey @Kyle_W - my apologies and thanks for catching that. I used the old Dev Dashboard terminology. I should have referred to the deprecated API call alerts in the Dev Dashboard’s Apps list and app Overview banners. My wording made it sound like there was a separate API Health report you could open…

Hey folks - we’ve seen reports in this related thread of merchant-facing “This app is unsupported” warnings now appearing during app installs alongside these deprecation alerts. We’re investigating and will follow up as soon as we have more to share.

Hey folks - I’ve followed up in the related thread and will close this thread as a duplicate to keep things in one place.

Deprecated API calls wrongly attributed to our app because third parties are reusing our public storefront access token

Hydrogen and Storefront APIs

Zak August 4, 2026, 12:51pm 2

Duplicate of Deprecated cartDiscountCodesUpdate (missing discountCodes) attributed to our app — but our code never calls it. How to identify the source store?

Topic		Replies	Views
Deprecated cartDiscountCodesUpdate (missing discountCodes) attributed to our app — but our code never calls it. How to identify the source store? Hydrogen and Storefront APIs storefront-api	30	589	October 8, 2026
Deprecated_api_calls.json returns "Not found" with new Dev Dashboard token (works with legacy app token) Dev Platform dev-dashboard	4	160	March 30, 2026
Bot orders attributed to our app via its public Storefront API token Dev Platform dev-stores	4	88	September 29, 2026
Deprecated offline token use detected in last 30 days Dev Platform dev-dashboard	10	428	July 13, 2026
Requests for checking deprecated REST API calls New GraphQL Product APIs	132	3814	November 20, 2025

Deprecated API calls wrongly attributed to our app because third parties are reusing our public storefront access token

Related topics