Want to store privateMetafields with Shopify resources and access them in liquid files

[sagar_at_avyya]

I want to store privateMetafields with Shopify resources and access them in liquid files!

I don't want to expose data to other apps or merchants so storing in metafields is not an option. But I can't seem to access privateMetafields from liquid templates,I read in the docs that

1. privateMetafields can't be accessed from liquid files

2. meta fields can be read/edited by accessed by merchants or other apps

Now, using meta fields to store dynamic data for Shopify resources is a security risk and privateMetafields can't be accessed from liquid so it kinda defeats the purpose! I would need to have an API call or something to get data into templates.

Any help would highly be appreciated.

Thank you very much.

[axis80]

I am running into this exact same issue.  I want to use the new Theme App Extensions so that customers can add my app blocks within the theme customizer.  I can pass the data to the theme extension's Liquid templates through public JSON metafields, however that is going to confuse storeowners when they see it.  I would much rather store it in private metafields so they don't have to see it, and so they can't mess things up by trying to edit it.

[sercanov]

Same blocker, I also mentioned in https://community.shopify.com/c/shopify-apis-and-sdks/how-to-store-external-api-key-with-theme-exten...

I was happy with ScriptTag implementation. Online Store 2.0 and Theme Extensions isn't featured enough for my business logic, or I'm missing something for weeks.

[sagar_at_avyya]

There could be one good solution to this issue: Use App owned Metafields,  Wrote in detail in the thread.

[sagar_at_avyya · Accepted solution]

There could be one good solution to this issue: Use App owned Metafields, 

EFFECTIVE APRIL 01, 2022

As of GraphQL Admin API version 2022-04, a new owner type ApiPermission is now available for metafields. A metafield with this permission type will only be readable and writable by the app that owns the metafield.

The app metafields are actually on app installations (as one app can have many installations based on merchants). Now these are somewhat safer than putting data on shop owned public metafields. 

These are accessilbe in the liquid file with the `app` object. {{ app.metafelds.namespace.key}}

Step1: Get App installation id

query {
  currentAppInstallation {
    id
  }
}

Step 2: Use that id as owner id to save metafield(s)

mutation ($metafields: [MetafieldsSetInput!]!) {
  metafieldsSet(metafields: $metafields) {
    metafields {
      id
    }
    userErrors {
      code
      field
      message
    }
  }
}

with metafilds variable:

metafields = [
  {
    ownerId: appInstallationId,
    namespace: 'namespace',
    key: 'key',
    value: 'value',
    type: "single_line_text_field"
  }
]

Step 3: Use those metafields in liquid files

{{ app.metafieds.namespace.key }}

That's it. Try it out let us know how it went.