Admin GraphQL API / 2026-04

App-owned metaobjects
can now be used without access scopes

$app:example App-owned metaobjects with types like this (including those created via declarative definitions) can now be read and written by the owning app itself, without requesting additional access scopes. Permission consent at install time gets one step simpler.

What's on this page
  1. What's actually changing (understand in 30 seconds)
  2. How it works: where the scope decision branches
  3. What is an "app-owned metaobject"?
  4. Old vs. new behavior compared
  5. Requirements
  6. Boundaries: what's covered and what isn't
  7. 5 points developers should know
  8. 3 practical use cases
  9. A one-line summary for your pitch

1What's actually changing

Metaobjects that an app owns itself ($app:example types like this; including those created via declarative definitions) — to read and write them,the additional access scopes that used to be required are no longer needed.
Developers are freed from unnecessary scope requests, and the friction of merchant-side permission consent is reduced too.

Before: scope request required

Even for app-only data, you couldn't read or write it without requesting metaobject access scopes. That adds to the permissions a merchant has to consent to at install time.

New: no scope needed

App-owned metaobjects can be used without additional scopes, as long as the request comes from the owning app itself.2026-04 Just use the Admin API from this version onward.

2How it works: where the scope decision branches

Owning app Admin API 2026-04+ The target metaobject is? $app:... app-owned Read/write without scopes merchant-owned merchant-owned read_metaobjects etc. required * On API versions before 2026-04, scopes are still required as before
The branching criterion is "who owns the metaobject". If it's app-owned ($app: type), no scope is needed; if it's merchant-owned, a scope is still required as before. The key point is that even for the same "metaobject," how it's handled changes depending on the owner.

3What is an "app-owned metaobject"?

$app:

$app: Prefixed types

When the type name $app:example such as $app: begins with this, the metaobject is identified as app-owned.

Declarative definitions are included too

Those created with declarative metaobject definitions are also included.

Used by the "owning app itself"

No scope is required when the app that owns the metaobject is the one using it.

4Old vs. new behavior compared

ItemBeforeNew (2026-04 and later)
app-owned($app:) read/write Scope required Requires requesting additional scopes No scope required No additional request for the owning app
Declarative metaobject definitions Adopt with additional scopes in mind Can adopt without a second thought
Reading/writing merchant-owned read_metaobjects etc. required Still required Scope still required, as before
Required API version 2026-04 and later
Friction for merchants More permission-consent items Reduced Unnecessary scope requests go away

5Requirements

2026-04

Admin API 2026-04 and later

To read and write app-owned metaobjects without scopes, the Admin API version must be 2026-04 or later.

Applies to use by the owning app

This applies to $app: metaobjects owned by that app, created via this type or via declarative definitions. It assumes the owning app itself is the one using them.

There is no documentation on migration steps for existing apps (the concrete flow for removing scopes or whether re-authorization is required). Verify the behavior when actually removing scopes ahead of time on the target API version.

6Boundaries: what's covered and what's not

No scopes required

app-owned metaobjects

$app:example App-owned metaobjects with types like this, including those created with declarative metaobject definitions. No scope is required as long as the owning app reads and writes them.

Scopes still required, as before

merchant-owned metaobject types

When working with merchant-owned metaobject types,read_metaobjects or write_metaobject_definitions and other individual scopes still need to be granted.

In short, "app-only data can shed its scope requirements by consolidating into app-owned,"but"the parts that touch merchant data still need scopes.". In apps where the two are mixed, sorting out which part of the code touches what becomes a prerequisite.

75 key points for developers

$app:

1. Applies only to $app: types

What no longer requires scopes: $app: -prefixed app-owned metaobjects. merchant-owned is excluded, and nothing changes in how it is handled.

2026-04

2. The API version is the dividing line

The no-scope behavior takes effect from 2026-04 onward. If you stay pinned to an older version, scopes are still required as before, so check your version pin first.

3. Declarative definitions are included too

App-owned metaobjects created with declarative metaobject definitions are also covered. When adopting the declarative approach, you no longer have to worry about requesting scopes.

scope

4. Merchant data still needs scopes

read_metaobjects / write_metaobject_definitions and the like remain necessary as long as you touch merchant-owned types. Don't mix up the spots where they coexist with app-owned.

5. Fewer permission consents at install time = room to rethink your design

By consolidating app-only state and settings into app-owned metaobjects, you can reduce the very number of scopes you request. That said, there is no documented step-by-step migration procedure (how to remove existing scopes, whether re-authorization is needed), so it is safest to verify in a sandbox before removing anything.

83 use cases you can put to work

Checking permissions
USE CASE 1

Lower app install friction and boost adoption

Challenge
Because the app uses metaobjects to store settings and state, it requests metaobject-related scopes, making the install-time permission consent screen heavy and contributing to drop-off.
Approach
Consolidate app-only data into $app: -type app-owned metaobjects, raise the Admin API to 2026-04 or later, and drop the corresponding extra scope requests.
Impact
Fewer permission consent items, with an expected improvement in install completion rate. Merchant concerns are eased as well.
Technical notes
Spots that touch merchant-owned types still require separate scopes. Only data kept entirely within app-owned is covered.
USE CASE 2

Spin up new apps quickly with declarative metaobject definitions

Challenge
You want to declaratively define your app's own data model, but requesting and managing additional scopes could become a drag on new development.
Approach
Define an app-owned data model with declarative metaobject definitions, and build from the start on the 2026-04 and-later API.
Impact
Since you don't assume a scope-request or re-consent flow, the design stays simpler and the path to release is shorter.
Technical notes
Things created with declarative definitions are also covered by the no-scope rule. Design on the assumption that the type is $app: from the outset.
USE CASE 3

Audit existing apps' scopes and move to least privilege

Challenge
An existing app requests read_metaobjects and the like, but it may actually touch only app-owned data, meaning it holds excessive permissions.
Approach
Audit your code to identify the spots that touch only app-owned data → move the API to 2026-04 and later → and remove the additional scope requests that are no longer needed.
Impact
Your setup follows the principle of least privilege, which is an advantage for app review and security. It's also easier to explain to merchants.
Technical notes
If even one path still touches a merchant-owned type, you can't drop that scope. Verify the behavior on the target API version before removing it.

9One-line summary you can use in a proposal

"App-owned ($app: types and declarative definitions included) metaobjectscan be read and written without additional scopes on Admin API 2026-04 and later.
If you move app-only data to app-owned, you can reduce the permissions requested at install time.
However, merchant-owned types still require scopes as beforeso just be careful to separate out the places where the two are mixed."