Metafield REST API Broken?

I noticed the Shopify integration that I was working on stopped working recently and found the culprit to be the POST method on the metafield endpoints.

I even went directly to the documentation and tried their example and it’s not working either: https://help.shopify.com/api/reference/metafield#create

Was there a breaking change or something? The GET methods worked fine, however on the POST method is returning an HTML based login page (which should not be happening for an API). The other endpoints return a generic JSON error if the API credentials are invalid, but I know mine are fine as I was ablet to use the other endpoints just fine.

Hey!

Are you sending cookies with these requests?

No this is a purely HTTP Client request with basic auth. I can reproduce this in C# and Postman.

What’s strange is that it was working last week, but I see you’ve made some breaking changes here recently to the other parts of the API so I wondered if something was broken by accident.

Hey Buddy,

No current issues with creating Metafields, I was able to do so using Insomnia as my client and the sample POST request in our docs. You’ll need to check the settings in your client. As Alex said, you may be passing cookies with your request (I know Postman, for example, has an option to do this).

Also, ensure you are passing application/json as the content-type and accept headers.

Cheers,

Sorry about that, I guess I jumped the the gun on Postman. Doesn’t show it sending any cookies but it’s obviously not playing well. I ended up trying something from a brand new project and I got it working so I’ll see where the disconnect is at. Thanks anyways, thought it seemed odd HTML (login page) was being returned so thought I would double check.

Actually digging into this a little more I ran across this breaking change (https://help.shopify.com/manual/your-account/account-security/tls) that went into effect a few days ago which lines up exactly when I noticed the app started having problems.

I went ahead and updated my app to use only TLS 1.2 and that stopped the HTML login page showing up. So now I’m getting the normal “[API] Invalid Username provided for Basic Auth API access”. I’ll have my client generate the keys again, thought I would share my experience for people who might have missed the TLS notice.

Hey guys,

I’m trying to do a similar thing here with Postman, but having a hard time figuring how to prevent Postman from passing cookies. Any insight you can give would be great.