We manage 30+ Shopify apps in one organization and deploy them through Shopify CLI in CI/CD.
With the move from SHOPIFY_CLI_PARTNERS_TOKEN to app-specific SHOPIFY_APP_AUTOMATION_TOKENs, this has become hard to manage at scale. Each app needs its own token, and with the current expiry limits that means a lot of manual token creation and rotation.
For 30 apps, even a six-month lifetime means at least 60 token rotations per year and it is not possible to use any automation for the rotation, as you need to manually perform it in the dev dashboard, copy it, paste it into a secrets manager for our CICD pipelines.
Are there plans for a more scalable organization-level automation model?
Possible solutions could be:
-
Bring back an organization-wide CLI token, ideally with more limited permissions
-
Workload identity / OIDC for CICD systems such as GitHub Actions
-
Programmatic creation and rotation of app automation tokens
The current app-scoped token model makes sense from a security perspective, but it creates significant operational overhead for organizations managing many apps.
There is already another thread where someone managing 9 production + 9 development apps raised essentially the same concern, so this seems likely to affect other larger app fleets as well.