The `cartDiscountCodeUpdate` mutation now requires the `discountCodes` field

Changelog
1

As part of the GraphQL Storefront API 2026-01 release, the cartDiscountCodesUpdate mutation now requires the discountCodes agrument to be included. Previously, the cartDiscountCodesUpdate mutation would accept a mutation with no discountCodes argument, which would not actually modify the cart in any way.

This is a companion discussion topic for the original entry at https://shopify.dev/changelog/the-cartdiscountcodeupdate-mutation-now-requires-the-discountcodes-field
2

Currently all versions are returning error when discountCodes is included:

{
    "errors": [
        {
            "message": "Field 'cartDiscountCodesUpdate' doesn't accept argument 'discountCodes'",
            "locations": [
                {
                    "line": 2,
                    "column": 44
                }
            ],
            "path": [
                "mutation cartDiscountCodesUpdate",
                "cartDiscountCodesUpdate",
                "discountCodes"
            ],
            "extensions": {
                "code": "argumentNotAccepted",
                "name": "cartDiscountCodesUpdate",
                "typeName": "Field",
                "argumentName": "discountCodes"
            }
        },
        {
            "message": "Variable $discountCodes is declared by cartDiscountCodesUpdate but not used",
            "locations": [
                {
                    "line": 1,
                    "column": 1
                }
            ],
            "path": [
                "mutation cartDiscountCodesUpdate"
            ],
            "extensions": {
                "code": "variableNotUsed",
                "variableName": "discountCodes"
            }
        }
    ]
}
3

I was able to resolve the issue by adding a storefront access token to the request.

4

When the storefront token is not provided, we correctly receive a 403 error, which is expected. However, since we’re now seeing a different error message, it indicates that the authentication process itself is working as intended.