When using the Shopify Storefront API with an X-Shopify-Storefront-Access-Token to query the product list, unlisted-type products are not returned and result in null or are omitted from the response.
1 Like
Having the same problem here
Hey folks, this is intended behavior. The Storefront API uses public access tokens so exposing unreleased products would be a security risk for merchants.
1 Like
Hey @Gray-Shopify , shouldnt they be returned if you search by handle or by product id? that would make sense or not? as the id has maybe been passed to the app somewhere else, maybe by a resource selector by the merchants, so the app should be able to fetch this product id or not?
Not if the product is unlisted. The Storefront API can only access public objects.
We may look at leveraging a private Storefront API token accessing data like that in the future, though.
1 Like
@Gray-Shopify Not correct, I managed to access an unlisted product through public Storefront API by providing the id, its possible tho
@Gray-Shopify I have to agree with the others here, an unlisted product is still accessible via it’s URL - so I feel that if you know the Product ID you should be able to fetch it via the Storefront API 
If someone wants to check every Product ID known to man to find unlisted products they’re welcome to 
Ah! I see we’re talking about the just released “unlisted” state! I thought this was about archived products. In that case the API is still behaving as expected. Here are the release notes for unlisted products:
We’ve introduced a new product status called “Unlisted”. It hides products from store search and collections, all sales channels, internet searches and Shopify Catalog—while still allowing access via a direct URL. It’s ideal for private sales, warranties, add-ons, or “free gift with purchase” items you don’t want discovered or used outside of their intended purpose.
1 Like
@Bobby_Yeung
Just to clarify then:
If it’s an unlisted product you can only access it using the Storefront API if you know the Product ID and access it directly.
Accessing it via other means won’t return any results (which is the desired behaviour)