Remove deprecated --shared-secret flag from shopify app webhook trigger#7522
Open
alfonso-noriega wants to merge 1 commit into
Open
Conversation
4 tasks
Contributor
Author
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced May 11, 2026
4 tasks
alfonso-noriega
temporarily deployed
to
breaking-change-approval
GitHub Actions
Inactive
…ger` The --shared-secret flag and SHOPIFY_FLAG_SHARED_SECRET env var on `shopify app webhook trigger` were deprecated in favor of --client-secret (SHOPIFY_FLAG_CLIENT_SECRET). This change removes them along with the deprecation warning and the fallback that copied --shared-secret into the service's clientSecret field.
alfonso-noriega
force-pushed
the
02-remove-app-release-force-flag
branch
from
3ba2c87 to
c36d5c2
Compare
alfonso-noriega
force-pushed
the
03-remove-webhook-trigger-shared-secret-flag
branch
from
2529e74 to
38ce793
Compare
Contributor
|
| Changeset | Package |
|---|---|
remove-app-deploy-force-flag.md |
'@shopify/app': major |
remove-app-release-force-flag.md |
'@shopify/app': major |
remove-webhook-trigger-shared-secret-flag.md |
'@shopify/app': major |
thin-webs-notice.md |
'@shopify/plugin-did-you-mean': major |
thin-webs-notice.md |
'@shopify/plugin-cloudflare': major |
thin-webs-notice.md |
'@shopify/create-app': major |
thin-webs-notice.md |
'@shopify/cli-kit': major |
thin-webs-notice.md |
'@shopify/store': major |
thin-webs-notice.md |
'@shopify/theme': major |
thin-webs-notice.md |
'@shopify/app': major |
thin-webs-notice.md |
'@shopify/cli': major |
thin-webs-notice.md |
'@shopify/e2e': major |
🏳️ Removed Flags
The following flags were removed from existing commands:
| Command | Flag |
|---|---|
app:webhook:trigger |
--shared-secret |
webhook:trigger |
--shared-secret |
🔧 Removed Environment Variables
The following env vars are no longer referenced in command flags:
| Env Var | Previously Used By |
|---|---|
SHOPIFY_FLAG_SHARED_SECRET |
app:webhook:trigger --shared-secret, webhook:trigger --shared-secret |
alfonso-noriega
temporarily deployed
to
breaking-change-approval
GitHub Actions
Inactive
isaacroldan
approved these changes
May 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
The
--shared-secretflag andSHOPIFY_FLAG_SHARED_SECRETenvironment variable onshopify app webhook triggerhave been deprecated for some time in favor of--client-secret(SHOPIFY_FLAG_CLIENT_SECRET). The command currently renders a deprecation warning when--shared-secretis used and falls back to copying it into the service'sclientSecretfield. This PR removes the deprecated flag in preparation for the next major release.Part of the deprecated-flag-removal stack: #7521 ← this PR → #7523.
WHAT is this pull request doing?
--shared-secretflag definition and theSHOPIFY_FLAG_SHARED_SECRETenv binding fromshopify app webhook trigger.flags['client-secret'] || flags['shared-secret']fallback in favor of justflags['client-secret'].sharedSecret(e.g. in the GraphQL request andsend-app-uninstalled-webhook.ts) are intentionally untouched — they correspond to the GraphQL schema and are unrelated to the user-facing flag.packages/cli/oclif.manifest.json,packages/cli/README.md, anddocs-shopify.dev/commands/interfaces/app-webhook-trigger.interface.ts.How to test your changes?
pnpm shopify app webhook trigger --shared-secret abcand confirm it now fails with an unknown-flag error.pnpm shopify app webhook trigger --helpand confirm--shared-secretis no longer listed and--client-secretis.pnpm shopify app webhook trigger --client-secret <secret> ...end-to-end and confirm the webhook is signed and delivered as before.Checklist
patchfor bug fixes ·minorfor new features ·majorfor breaking changes) and added a changeset withpnpm changeset add