Unable to allow customer access to metaobject

Shopify CLI and Libraries
1

I have reproduced the issue on the latest CLI version.

Yes, I am on the latest version

I have searched existing posts and this report is not a duplicate.

Yes, this isn’t a duplicate

In which of these areas are you experiencing a problem?

App

Expected behavior

[metaobjects.app.credit_account]
name = "Credits"

  [metaobjects.app.credit_account.access]
  admin = "merchant_read_write"
  customer_account = "read"

This config in shopify.app.toml should allow reading the metaobject with the Customer Account API.

Actual behavior

$ shopify app dev
error
Validation error in shopify.app.toml: [metaobjects.app.credit_account.access]: must NOT have additional properties

Reproduction steps

  1. Configure access on custom app metaobject with customer_account.
  2. Run shopify app dev → error occurs.
  3. Remove customer account access in config
  4. Run shopify app dev again → no error.

Verbose output

shopify app dev --verbose
2026-08-05T13:12:17.851Z: Running command app dev
2026-08-05T13:12:17.854Z: Running system process in background:
  · Command: /opt/homebrew/Cellar/node/26.6.0/bin/node /opt/homebrew/bin/shopify notifications list --ignore-errors
  · Working directory: /Users/tomo/Projects/lgg-shp-extensions

2026-08-05T13:12:17.862Z: Notifications to show: 0
2026-08-05T13:12:17.873Z: Reading the content of file at shopify.app.toml...
2026-08-05T13:12:17.877Z: Reading the content of file at extensions/guthaben/shopify.extension.toml...
2026-08-05T13:12:17.885Z: Reading the content of file at shopify.web.toml...
2026-08-05T13:12:17.886Z: Looking for a lockfile in /Users/tomo/Projects/lgg-shp-extensions...
2026-08-05T13:12:17.886Z: Reading the content of file at package.json...
2026-08-05T13:12:17.886Z: Reading the content of file at package.json...
2026-08-05T13:12:17.887Z: Reading the content of file at .shopify/project.json...
2026-08-05T13:12:17.888Z: Reading cached app information for directory /Users/tomo/Projects/lgg-shp-extensions...
2026-08-05T13:12:17.889Z: Ensuring that the user is authenticated with the App Management API with the following scopes:
[]

2026-08-05T13:12:17.889Z: Getting session store...
2026-08-05T13:12:17.890Z: Getting current session ID...
2026-08-05T13:12:17.891Z: Validating existing session against the scopes:
[
  "openid",
  "https://api.shopify.com/auth/shop.admin.graphql",
  "https://api.shopify.com/auth/shop.admin.themes",
  "https://api.shopify.com/auth/partners.collaborator-relationships.readonly",
  "https://api.shopify.com/auth/shop.storefront-renderer.devtools",
  "https://api.shopify.com/auth/partners.app.cli.access",
  "https://api.shopify.com/auth/destinations.readonly",
  "https://api.shopify.com/auth/organization.store-management",
  "https://api.shopify.com/auth/organization.on-demand-user-access",
  "https://api.shopify.com/auth/organization.apps.manage"
]
For applications:
{
  "appManagementApi": {
    "scopes": []
  },
  "businessPlatformApi": {
    "scopes": []
  }
}

2026-08-05T13:12:17.891Z: - Token validation -> It's expired: false
2026-08-05T13:12:17.892Z: Sending "BusinessPlatform" GraphQL request:
  query UserInfo {
  currentUserAccount {
    uuid
    email
    organizations(first: 2) {
      nodes {
        name
        __typename
      }
      __typename
    }
    __typename
  }
}

With request headers:
 - User-Agent: Shopify CLI; v=4.6.0
 - Keep-Alive: timeout=30
 - Sec-CH-UA-PLATFORM: darwin
 - Content-Type: application/json

to https://destinations.shopifysvc.com/destinations/api/2020-07/graphql
2026-08-05T13:12:17.898Z: Sending "App Management" GraphQL request:
  query ActiveAppReleaseFromApiKey($apiKey: String!) {
  app: appByKey(key: $apiKey) {
    ...AppVersionInfo
    __typename
  }
}

fragment ReleasedAppModule on AppModule {
  uuid
  userIdentifier
  handle
  config
  target
  specification {
    identifier
    externalIdentifier
    name
    experience
    managementExperience
  }
}

fragment AppVersionInfo on App {
  id
  key
  organizationId
  activeRoot {
    clientCredentials {
      secrets {
        key
      }
    }
    grantedShopifyApprovalScopes
  }
  activeRelease {
    id
    version {
      name
      appModules {
        ...ReleasedAppModule
      }
    }
  }
}

With variables:
{
  "apiKey": "*****"
}

With request headers:
 - User-Agent: Shopify CLI; v=4.6.0
 - Keep-Alive: timeout=30
 - Sec-CH-UA-PLATFORM: darwin
 - Content-Type: application/json

to https://app.shopify.com/app_management/unstable/graphql.json
2026-08-05T13:12:18.510Z: Request to https://app.shopify.com/app_management/unstable/graphql.json completed in 612 ms
With response headers:
 - content-type: application/json; charset=utf-8
 - server-timing: processing;dur=247, verdict_flag_enabled;desc="count=3";dur=0.17, _y;desc="617ae807-7b77-41ff-8174-9f42e2cacaf3", _s;desc="4dc90191-09cc-442e-a58b-7272e691d355"
 - x-request-id: 019fd20d-a7c5-7761-bc30-a86e3a0cd46e-1785935538
    
2026-08-05T13:12:18.512Z: Sending "BusinessPlatform" GraphQL request:
  query FindOrganizations($organizationId: OrganizationID!) {
  currentUserAccount {
    organization(id: $organizationId) {
      id
      name
      __typename
    }
    __typename
  }
}

With variables:
{
  "organizationId": "Z2lkOi8vb3JnYW5pemF0aW9uL09yZ2FuaXphdGlvbi8xMjI5Mjg2MzE="
}

With request headers:
 - User-Agent: Shopify CLI; v=4.6.0
 - Keep-Alive: timeout=30
 - Sec-CH-UA-PLATFORM: darwin
 - Content-Type: application/json

to https://destinations.shopifysvc.com/destinations/api/2020-07/graphql
2026-08-05T13:12:18.516Z: Sending "App Management" GraphQL request:
  query fetchSpecifications($organizationId: ID!) {
  specifications(organizationId: $organizationId) {
    name
    identifier
    externalIdentifier
    experience
    features
    uidStrategy {
      __typename
      appModuleLimit
      isClientProvided
    }
    validationSchema {
      jsonSchema
      __typename
    }
    __typename
  }
}

With variables:
{
  "organizationId": "gid://shopify/Organization/122928631"
}

With request headers:
 - User-Agent: Shopify CLI; v=4.6.0
 - Keep-Alive: timeout=30
 - Sec-CH-UA-PLATFORM: darwin
 - Content-Type: application/json

to https://app.shopify.com/app_management/unstable/graphql.json
2026-08-05T13:12:19.188Z: Request to https://app.shopify.com/app_management/unstable/graphql.json completed in 672 ms
With response headers:
 - content-type: application/json; charset=utf-8
 - server-timing: processing;dur=464, verdict_flag_enabled;desc="count=9";dur=0.552, _y;desc="d0ef5a7a-17a4-4e69-a956-6998c839abf1", _s;desc="d99cb2b3-2627-46cc-bc91-9eedb9db3755"
 - x-request-id: 019fd20d-a99b-7ec4-b398-af96f6a67f96-1785935538
    
2026-08-05T13:12:19.204Z: The following extension specifications were defined locally but not found in the remote specifications: tax_calculation
2026-08-05T13:12:19.204Z: The following extension specifications were found in the remote specifications but not defined locally: admin_app
2026-08-05T13:12:19.206Z: Reading the content of file at .gitignore...
2026-08-05T13:12:19.397Z: Notifications to show: 0
2026-08-05T13:12:19.489Z: Sync-reading the content of file at extensions/guthaben/src/CreditAccountBlock.tsx...
2026-08-05T13:12:19.501Z: Sync-reading the content of file at node_modules/@shopify/ui-extensions/build/ts/surfaces/customer-account/targets/customer-account.profile.company-location-payment.render-after.d.ts...
2026-08-05T13:12:19.529Z: Sync-reading the content of file at extensions/guthaben/shopify.d.ts...
╭─ error ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                                                                 │
│  Validation error in shopify.app.toml:                                                                                                          │
│                                                                                                                                                 │
│  [metaobjects.app.credit_account.access]: must NOT have additional properties                                                                   │
│                                                                                                                                                 │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

2026-08-05T13:12:19.563Z: Looking for a lockfile in /Users/tomo/Projects/lgg-shp-extensions...
2026-08-05T13:12:19.583Z: Request to https://monorail-edge.shopifysvc.com/v1/produce completed in 9 ms
With response headers:

    
2026-08-05T13:12:19.583Z: Failed to report usage analytics: request to https://monorail-edge.shopifysvc.com/v1/produce failed, reason: 
2026-08-05T13:12:19.583Z: Failed to report usage analytics: request to https://monorail-edge.shopifysvc.com/v1/produce failed, reason: 
2026-08-05T13:12:19.583Z: Skipping Bugsnag report for expected error

Operating system

macOS 26.6

CLI version

4.6.0

Shell

zsh

Nodejs version

v26.6.0

What language and version are you using in your application?

TypeScript 5.9.3

2

The error message is a schema validation failure rather than a permissions problem, which is a useful distinction: “must NOT have additional properties” means the CLI’s JSON schema for that access block simply doesn’t have a customer_account key defined, so it rejects it before anything ever reaches the platform. That’s why removing the line makes the error disappear — you’re not being denied access, the key isn’t recognised at all.

So the practical workaround while this is unresolved is to keep the TOML limited to the keys the schema accepts and set the access you actually want out-of-band, via the Admin GraphQL API against the metaobject definition after it exists. That decouples you from the CLI’s validation and lets you confirm whether the platform itself supports customer account reads for app-owned metaobjects, which is the thing worth establishing before you build around it — it’s possible the schema gap is just the CLI lagging, but it’s also possible customer account access isn’t wired up for app-owned definitions yet, and those two have very different implications for your extension.

Worth pinning down explicitly in your report, if you haven’t: whether reading the metaobject through the Customer Account API works when the definition is granted access through the Admin API directly. If it does, this is purely a CLI schema fix. If it doesn’t, the TOML key would be misleading even once it validates. That distinction will probably get you a faster answer from the CLI team.

One small thing that might matter for reproduction: you’re on Node 26 and CLI 4.6.0 on macOS 26, which is a fairly forward stack, so it’s worth confirming the same validation error appears on a Node LTS release before anyone chases an environment-specific cause.

3

Thanks for the suggestion.

I called the Admin GraphQL API directly against the metaobject definition to set customer_account access out-of-band, but it’s rejected server-side:

Definition is managed by app configuration and cannot be modified through the API.

I also dug into the CLI itself to see whether this is a local schema bug. The validation schema for app config is actually fetched from Shopify’s servers at runtime, not bundled with the CLI. So the restriction isn’t a CLI-side artifact, it’s coming from the platform.

To confirm that, I bypassed the local TOML validation in the CLI so it would let the config through anyway. The dev server still rejected it once it reached Shopify’s backend, because customer_account isn’t an allowed field for this access block server-side.

Given that this seems to be a platform-level limitation rather than a CLI issue, I’m wondering whether this thread is getting the right eyes on it here in CLI and Libraries, or whether it should be moved/cross-posted to a more appropriate category to reach the team that actually owns this behavior?

4

Hey @tomo_2403 - thanks for digging into this further. It does seem like something odd is happening here.

Could you share the x-request-id from the failed metaobjectDefinitionUpdate response, along with the API version, exact mutation and userErrors, and approximate timestamp? I’d just redact any tokens or shop-sensitive details if you can please!

That should give us a better example to trace on our end. I’ll keep you in the loop.

5

Hello @Alan_G, thanks for your reply. As requested:

Request

POST https://[REDACTED].myshopify.com/admin/api/2026-07/graphql.json

mutation MetaobjectDefinitionUpdate {
    metaobjectDefinitionUpdate(
        id: "gid://shopify/MetaobjectDefinition/45049643340"
        definition: { access: { customerAccount: READ } }
    ) {
        userErrors {
            code
            elementIndex
            elementKey
            field
            message
        }
    }
}

Response

on Fri, 07 Aug 2026 07:25:01 GMT
x-request-id: 3c5640ad-9f2f-4d87-ae62-963febbeab70-1786087283

{
    "data": {
        "metaobjectDefinitionUpdate": {
            "userErrors": [
                {
                    "code": "APP_CONFIG_MANAGED",
                    "elementIndex": null,
                    "elementKey": null,
                    "field": [
                        "definition"
                    ],
                    "message": "Definition is managed by app configuration and cannot be modified through the API."
                }
            ]
        }
    }
}
6

Thanks @tomo_2403 - looking into this for you. Really appreciate the example!

8

Hey @tomo_2403 - I was able to check with some folks on this. We’re looking into improving support for customer account access within TOML-managed metaobject definitions. I can’t guarantee what the eventual change will look like or provide a timeline, but it’s on our radar.

For now, the workaround is to create and manage the metaobject definition through the Admin API or Shopify admin instead of TOML if you need Customer Account API access.

9

Thanks @Alan_G for looking into this and confirming there’s a workaround for now.

Could you give me a sense of how this is prioritized internally — is it something actively being scoped, or is it currently just sitting in the backlog without a clear priority yet? The reason I’m asking is that I’ve already integrated this feature fairly deeply into my app before running into this limitation. If a fix isn’t too far out, I’d rather hold off on reworking things now and wait for it instead of doing a bunch of reworks that might end up being unnecessary.

10

Hey @tomo_2403, thanks for following up. I checked further and can confirm this is a gap in the current support for TOML-managed metaobject definitions. A change is being worked through internally on our end, but I don’t have a rollout timeline I can safely share yet.

Since it hasn’t shipped, I wouldn’t recommend blocking your release around it. The supported option today is still to create a merchant-owned definition through the Admin API or Shopify admin and enable Customer Account access there. I realize that may involve some rework if you’re already using the $app:credit_account type.

We are working on this, but I can’t confirm any rollout details at the moment - hope this helps a little bit at least.