I have reproduced the issue on the latest CLI version.
Yes, I am on the latest version
I have searched existing posts and this report is not a duplicate.
Yes, this isn’t a duplicate
In which of these areas are you experiencing a problem?
Other
Expected behavior
shopify app dev should start without saying store password is incorrect after asking for it previously before updating.
Actual behavior
shopify app dev prompts to following every time, even after entering the password:
? Incorrect store password (
https://redacted.myshopify.com/admin/online_store/preferences ).
Please try again:
> █
▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
Reproduction steps
npm i -g @shopify/cli@latest
shopify app dev
Verbose output
2026-05-28T10:47:49.419Z: Sending "Admin" GraphQL request:
query {
products(first: 1, query: "published_status:published") {
edges {
node {
id
variants(first: 1) {
edges {
node {
id
}
}
}
}
}
}
}
With request headers:
- User-Agent: Shopify CLI; v=4.1.0
- Keep-Alive: timeout=30
- Sec-CH-UA-PLATFORM: darwin
- Content-Type: application/json
to https://tom-dev-supercycle.myshopify.com/admin/api/2026-04/graphql.json
2026-05-28T10:47:49.746Z: Request to https://tom-dev-supercycle.myshopify.com/admin/api/2026-04/graphql.json completed in 327 ms
With response headers:
- content-type: application/json; charset=utf-8
- server-timing: processing;dur=102, verdict_flag_enabled;desc="count=15";dur=0.839, graphql;desc="admin/query/other", _y;desc="ddaa00ba-9dd3-4a91-919d-456f5a3c6d75", _s;desc="51a49dca-08a4-4d99-aa79-0594a29082e7"
- x-request-id: 2af871c3-5576-4668-99c9-96bcbc3d8298-1779965269
2026-05-28T10:47:49.747Z: Ensuring that the user is authenticated with the Admin API with the following scopes for the store tom-dev-supercycle.myshopify.com:
[]
2026-05-28T10:47:49.747Z: Getting session store...
2026-05-28T10:47:49.748Z: Getting current session ID...
2026-05-28T10:47:49.749Z: Validating existing session against the scopes:
[
"openid",
"https://api.shopify.com/auth/shop.admin.graphql",
"https://api.shopify.com/auth/shop.admin.themes",
"https://api.shopify.com/auth/partners.collaborator-relationships.readonly",
"https://api.shopify.com/auth/shop.storefront-renderer.devtools",
"https://api.shopify.com/auth/partners.app.cli.access",
"https://api.shopify.com/auth/destinations.readonly",
"https://api.shopify.com/auth/organization.store-management",
"https://api.shopify.com/auth/organization.on-demand-user-access",
"https://api.shopify.com/auth/organization.apps.manage"
]
For applications:
{
"adminApi": {
"scopes": [],
"storeFqdn": "tom-dev-supercycle.myshopify.com"
}
}
2026-05-28T10:47:49.749Z: - Token validation -> It's expired: false
2026-05-28T10:47:49.750Z: Sending "Admin" GraphQL request:
query OnlineStorePasswordProtection {
onlineStore {
passwordProtection {
enabled
__typename
}
__typename
}
}
With request headers:
- User-Agent: Shopify CLI; v=4.1.0
- Keep-Alive: timeout=30
- Sec-CH-UA-PLATFORM: darwin
- Content-Type: application/json
to https://tom-dev-supercycle.myshopify.com/admin/api/2026-04/graphql.json
2026-05-28T10:47:50.076Z: Request to https://tom-dev-supercycle.myshopify.com/admin/api/2026-04/graphql.json completed in 326 ms
With response headers:
- content-type: application/json; charset=utf-8
- server-timing: processing;dur=77, verdict_flag_enabled;desc="count=10";dur=0.478, graphql;desc="admin/query/other", _y;desc="c5338393-3402-41d6-812c-205438ab5363", _s;desc="a86b13ed-be0f-4a5f-bf5a-7a9fccc12482"
- x-request-id: d80c6bce-9a05-4963-8b74-cdeae5264340-1779965269
2026-05-28T10:47:50.079Z: Sending POST request to URL https://tom-dev-supercycle.myshopify.com/password
With request headers:
- cache-control: no-cache
- content-type: application/x-www-form-urlencoded
2026-05-28T10:47:50.362Z: Request to https://tom-dev-supercycle.myshopify.com/password completed in 282 ms
With response headers:
- cache-control: no-cache, no-store
- content-type: text/html; charset=utf-8
- server-timing: processing;dur=44;desc="gc:1", db;dur=20, asn;desc="5631", edge;desc="LHR", country;desc="GB", theme;desc="157322772717", pageType;desc="password", servedBy;desc="sfps", requestID;desc="c160621c-70ba-4cb4-ad06-7fbbcb6f7f81-1779965270", _y;desc="00000000-0000-0000-5000-000000000000", _s;desc="00000000-0000-0000-5000-000000000000", _cmp;desc="3.ampS_GBENG_t_f_-nfn8py5R3-vSlfIlhf8yg"
- x-request-id: c160621c-70ba-4cb4-ad06-7fbbcb6f7f81-1779965270
Truncated to the last part before it prompts, due to limits of body size.
Operating system
macOS 26.5
CLI version
4.1.0
Shell
zsh
Nodejs version
v24.15.0
