Shopify · isaacroldan · Oct 23, 2025 · Oct 23, 2025
@@ -0,0 +1,5 @@
+---
+'@shopify/app': minor
+---
+
+Removed support for "--api-key" and "SHOPIFY_API_KEY". Use "--client-id" or "SHOPIFY_FLAG_CLIENT_ID" instead
@@ -1,6 +1,5 @@
 import {appFlags} from '../../flags.js'
 import build from '../../services/build.js'
-import {showApiKeyDeprecationWarning} from '../../prompts/deprecation-warnings.js'
 import {localAppContext} from '../../services/app-context.js'
 import AppUnlinkedCommand, {AppUnlinkedCommandOutput} from '../../utilities/app-unlinked-command.js'
 import {Flags} from '@oclif/core'
@@ -25,20 +24,11 @@ export default class Build extends AppUnlinkedCommand {
       env: 'SHOPIFY_FLAG_SKIP_DEPENDENCIES_INSTALLATION',
       default: false,
     }),
-    'api-key': Flags.string({
-      hidden: true,
-      description: "Application's API key that will be exposed at build time.",
-      env: 'SHOPIFY_FLAG_API_KEY',
-      exclusive: ['config'],
-    }),
   }
 
   async run(): Promise<AppUnlinkedCommandOutput> {
     const {flags} = await this.parse(Build)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
-    const apiKey = flags['client-id'] ?? flags['api-key']
+    const clientId = flags['client-id']
 
     await addPublicMetadata(() => ({
       cmd_app_dependency_installation_skipped: flags['skip-dependencies-installation'],
@@ -49,7 +39,7 @@ export default class Build extends AppUnlinkedCommand {
       userProvidedConfigName: flags.config,
     })
 
-    await build({app, skipDependenciesInstallation: flags['skip-dependencies-installation'], apiKey})
+    await build({app, skipDependenciesInstallation: flags['skip-dependencies-installation'], apiKey: clientId})
 
     return {app}
   }

@@ -2,7 +2,6 @@ import {appFlags} from '../../flags.js'
 import {deploy} from '../../services/deploy.js'
 import {getAppConfigurationState} from '../../models/app/loader.js'
 import {validateVersion} from '../../validations/version-name.js'
-import {showApiKeyDeprecationWarning} from '../../prompts/deprecation-warnings.js'
 import {validateMessage} from '../../validations/message.js'
 import metadata from '../../metadata.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../utilities/app-linked-command.js'
@@ -26,12 +25,6 @@ export default class Deploy extends AppLinkedCommand {
   static flags = {
     ...globalFlags,
     ...appFlags,
-    'api-key': Flags.string({
-      hidden: true,
-      description: 'The API key of your app.',
-      env: 'SHOPIFY_FLAG_APP_API_KEY',
-      exclusive: ['config'],
-    }),
     force: Flags.boolean({
       hidden: false,
       description: 'Deploy without asking for confirmation.',
@@ -81,27 +74,22 @@ export default class Deploy extends AppLinkedCommand {
     validateVersion(flags.version)
     validateMessage(flags.message)
 
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    } else if (process.env.SHOPIFY_API_KEY) {
-      flags['api-key'] = process.env.SHOPIFY_API_KEY
-    }
-    const apiKey = flags['client-id'] || flags['api-key']
+    const clientId = flags['client-id']
 
     await addPublicMetadata(() => ({
       cmd_app_reset_used: flags.reset,
     }))
 
     const requiredNonTTYFlags = ['force']
     const configurationState = await getAppConfigurationState(flags.path, flags.config)
-    if (configurationState.state === 'template-only' && !apiKey) {
+    if (configurationState.state === 'template-only' && !clientId) {
       requiredNonTTYFlags.push('client-id')
     }
     this.failMissingNonTTYFlags(flags, requiredNonTTYFlags)
 
     const {app, remoteApp, developerPlatformClient, organization} = await linkedAppContext({
       directory: flags.path,
-      clientId: apiKey,
+      clientId,
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,6 +1,5 @@
 import {appFlags} from '../../flags.js'
 import {dev, DevOptions} from '../../services/dev.js'
-import {showApiKeyDeprecationWarning} from '../../prompts/deprecation-warnings.js'
 import {checkFolderIsValidApp} from '../../models/app/loader.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../services/app-context.js'
@@ -21,12 +20,6 @@ export default class Dev extends AppLinkedCommand {
   static flags = {
     ...globalFlags,
     ...appFlags,
-    'api-key': Flags.string({
-      hidden: true,
-      description: 'The API key of your app.',
-      env: 'SHOPIFY_FLAG_APP_API_KEY',
-      exclusive: ['config'],
-    }),
     store: Flags.string({
       char: 's',
       description: 'Store URL. Must be an existing development or Shopify Plus sandbox store.',
@@ -102,13 +95,6 @@ export default class Dev extends AppLinkedCommand {
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(Dev)
 
-    if (!flags['api-key'] && process.env.SHOPIFY_API_KEY) {
-      flags['api-key'] = process.env.SHOPIFY_API_KEY
-    }
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
-
     const tunnelMode = await getTunnelMode({
       useLocalhost: flags['use-localhost'],
       tunnelUrl: flags['tunnel-url'],
@@ -127,7 +113,7 @@ export default class Dev extends AppLinkedCommand {
 
     const appContextResult = await linkedAppContext({
       directory: flags.path,
-      clientId: flags['client-id'] ?? flags['api-key'],
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,7 +1,6 @@
 import {chooseFunction, functionFlags} from '../../../services/function/common.js'
 import {replay} from '../../../services/function/replay.js'
 import {appFlags} from '../../../flags.js'
-import {showApiKeyDeprecationWarning} from '../../../prompts/deprecation-warnings.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../../services/app-context.js'
 import {globalFlags, jsonFlag} from '@shopify/cli-kit/node/cli'
@@ -19,12 +18,6 @@ export default class FunctionReplay extends AppLinkedCommand {
     ...appFlags,
     ...functionFlags,
     ...jsonFlag,
-    'api-key': Flags.string({
-      hidden: true,
-      description: "Application's API key",
-      env: 'SHOPIFY_FLAG_API_KEY',
-      exclusive: ['config'],
-    }),
     log: Flags.string({
       char: 'l',
       description:
@@ -43,13 +36,10 @@ export default class FunctionReplay extends AppLinkedCommand {
 
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(FunctionReplay)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
 
     const {app} = await linkedAppContext({
       directory: flags.path,
-      clientId: flags['client-id'] ?? flags['api-key'],
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,6 +1,5 @@
 import {generateSchemaService} from '../../../services/generate-schema.js'
 import {chooseFunction, functionFlags} from '../../../services/function/common.js'
-import {showApiKeyDeprecationWarning} from '../../../prompts/deprecation-warnings.js'
 import {appFlags} from '../../../flags.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../../services/app-context.js'
@@ -20,13 +19,6 @@ export default class FetchSchema extends AppLinkedCommand {
     ...globalFlags,
     ...appFlags,
     ...functionFlags,
-    'api-key': Flags.string({
-      hidden: true,
-      name: 'API key',
-      description: 'The API key to fetch the schema with.',
-      env: 'SHOPIFY_FLAG_APP_API_KEY',
-      exclusive: ['config'],
-    }),
     stdout: Flags.boolean({
       description: 'Output the schema to stdout instead of writing to a file.',
       required: false,
@@ -37,14 +29,10 @@ export default class FetchSchema extends AppLinkedCommand {
 
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(FetchSchema)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
-    const apiKey = flags['client-id'] ?? flags['api-key']
 
     const {app, developerPlatformClient, organization} = await linkedAppContext({
       directory: flags.path,
-      clientId: apiKey,
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,7 +1,6 @@
 import {appFlags} from '../../../flags.js'
 import metadata from '../../../metadata.js'
 import generate from '../../../services/generate.js'
-import {showApiKeyDeprecationWarning} from '../../../prompts/deprecation-warnings.js'
 import {checkFolderIsValidApp} from '../../../models/app/loader.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../../services/app-context.js'
@@ -53,12 +52,6 @@ export default class AppGenerateExtension extends AppLinkedCommand {
       options: ['vanilla-js', 'react', 'typescript', 'typescript-react', 'wasm', 'rust'],
       env: 'SHOPIFY_FLAG_FLAVOR',
     }),
-    'api-key': Flags.string({
-      hidden: true,
-      description: 'The API key of your app.',
-      env: 'SHOPIFY_FLAG_APP_API_KEY',
-      exclusive: ['config'],
-    }),
   }
 
   public static analyticsNameOverride(): string | undefined {
@@ -67,9 +60,6 @@ export default class AppGenerateExtension extends AppLinkedCommand {
 
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(AppGenerateExtension)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
 
     await metadata.addPublicMetadata(() => ({
       cmd_scaffold_required_auth: true,
@@ -89,7 +79,7 @@ export default class AppGenerateExtension extends AppLinkedCommand {
 
     const {app, specifications, remoteApp, developerPlatformClient} = await linkedAppContext({
       directory: flags.path,
-      clientId: flags['client-id'] ?? flags['api-key'],
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,4 +1,3 @@
-import Dev from './dev.js'
 import {checkFolderIsValidApp} from '../../models/app/loader.js'
 import {logs, Format} from '../../services/logs.js'
 import {appFlags} from '../../flags.js'
@@ -27,7 +26,6 @@ export default class Logs extends AppLinkedCommand {
     ...globalFlags,
     ...appFlags,
     ...jsonFlag,
-    'api-key': Dev.flags['api-key'],
     store: Flags.string({
       char: 's',
       description: 'Store URL. Must be an existing development or Shopify Plus sandbox store.',
@@ -50,13 +48,11 @@ export default class Logs extends AppLinkedCommand {
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(Logs)
 
-    const apiKey = flags['client-id'] ?? flags['api-key']
-
     await checkFolderIsValidApp(flags.path)
 
     const appContextResult = await linkedAppContext({
       directory: flags.path,
-      clientId: apiKey,
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,6 +1,5 @@
 import {appFlags} from '../../flags.js'
 import {release} from '../../services/release.js'
-import {showApiKeyDeprecationWarning} from '../../prompts/deprecation-warnings.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../services/app-context.js'
 import {getAppConfigurationState} from '../../models/app/loader.js'
@@ -20,12 +19,6 @@ export default class Release extends AppLinkedCommand {
   static flags = {
     ...globalFlags,
     ...appFlags,
-    'api-key': Flags.string({
-      hidden: true,
-      description: 'The API key of your app.',
-      env: 'SHOPIFY_FLAG_APP_API_KEY',
-      exclusive: ['config'],
-    }),
     force: Flags.boolean({
       hidden: false,
       description: 'Release without asking for confirmation.',
@@ -42,25 +35,22 @@ export default class Release extends AppLinkedCommand {
 
   async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(Release)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
-    const apiKey = flags['client-id'] ?? flags['api-key']
+    const clientId = flags['client-id']
 
     await addPublicMetadata(() => ({
       cmd_app_reset_used: flags.reset,
     }))
 
     const requiredNonTTYFlags = ['force']
     const configurationState = await getAppConfigurationState(flags.path, flags.config)
-    if (configurationState.state === 'template-only' && !apiKey) {
+    if (configurationState.state === 'template-only' && !clientId) {
       requiredNonTTYFlags.push('client-id')
     }
     this.failMissingNonTTYFlags(flags, requiredNonTTYFlags)
 
     const {app, remoteApp, developerPlatformClient} = await linkedAppContext({
       directory: flags.path,
-      clientId: apiKey,
+      clientId,
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })

@@ -1,10 +1,8 @@
 import {appFlags} from '../../../flags.js'
 import versionList from '../../../services/versions-list.js'
-import {showApiKeyDeprecationWarning} from '../../../prompts/deprecation-warnings.js'
 import AppLinkedCommand, {AppLinkedCommandOutput} from '../../../utilities/app-linked-command.js'
 import {linkedAppContext} from '../../../services/app-context.js'
 import {globalFlags, jsonFlag} from '@shopify/cli-kit/node/cli'
-import {Flags} from '@oclif/core'
 
 export default class VersionsList extends AppLinkedCommand {
   static summary = 'List deployed versions of your app.'
@@ -17,24 +15,14 @@ export default class VersionsList extends AppLinkedCommand {
     ...globalFlags,
     ...appFlags,
     ...jsonFlag,
-    'api-key': Flags.string({
-      hidden: true,
-      description: "Application's API key to fetch versions for.",
-      env: 'SHOPIFY_FLAG_API_KEY',
-      exclusive: ['config'],
-    }),
   }
 
   public async run(): Promise<AppLinkedCommandOutput> {
     const {flags} = await this.parse(VersionsList)
-    if (flags['api-key']) {
-      await showApiKeyDeprecationWarning()
-    }
-    const apiKey = flags['client-id'] ?? flags['api-key']
 
     const {app, remoteApp, developerPlatformClient, organization} = await linkedAppContext({
       directory: flags.path,
-      clientId: apiKey,
+      clientId: flags['client-id'],
       forceRelink: flags.reset,
       userProvidedConfigName: flags.config,
     })