Hi @KyleG-Shopify Thanks for the response here.
To clarify, there are situations where using an embedded CLI app created from a template are not feasible. For example, legacy systems and 3rd party integrations. For these cases, the guidance from Shopify seems to be to use client credentials grant; however, it’s not practical due to the permissions issues outlined above. Custom distribution works for a new app created from the template, but this doesn’t account for all use cases.
For shopify app execute / shopify app bulk execute, this actually appears to be the same client credentials issue based on the link you shared - thanks for that. We had a use case yesterday, where we have a custom extension-only app installed on a shop that we have collaborator access to. It has 5 extensions of relatively high complexity and is critical for checkout and fulfilment operations. We needed to run a bulk export against ~20,000 products to find any products that had a specific variant metafield missing, as our extension app relies on that field. This would have been really easy to do with shopify app execute, (and nice Dx!) but when we tried, we got the org permissions error.
I suppose this thread could be a feature request for a system where merchants can grant permission to collaborators / partners to use client credentials?