There could be one good solution to this issue: Use App owned Metafields,
EFFECTIVE APRIL 01, 2022
As of GraphQL Admin API version 2022-04, a new owner type ApiPermission is now available for metafields. A metafield with this permission type will only be readable and writable by the app that owns the metafield.
The app metafields are actually on app installations (as one app can have many installations based on merchants). Now these are somewhat safer than putting data on shop owned public metafields.
These are accessilbe in the liquid file with the app object. {{ app.metafelds.namespace.key}}
Step1: Get App installation id
query {
currentAppInstallation {
id
}
}
Step 2: Use that id as owner id to save metafield(s)
mutation ($metafields: [MetafieldsSetInput!]!) {
metafieldsSet(metafields: $metafields) {
metafields {
id
}
userErrors {
code
field
message
}
}
}
with metafilds variable:
metafields = [
{
ownerId: appInstallationId,
namespace: 'namespace',
key: 'key',
value: 'value',
type: "single_line_text_field"
}
]
Step 3: Use those metafields in liquid files
{{ app.metafieds.namespace.key }}
That’s it. Try it out let us know how it went.