Thanks, @Tim-Shopify
I’ve tried the storefront API with tokenless access, and it works well in my theme app extension.
Just a minor issue. Is there any way to move the storefront API version away from the code? Shopify function uses a toml file to store the API version, but there is no similar way for TAE