sincecutoff.com
← all changes

shopify theme pull and push can use matching store auth sessions

Introduced 2026-07-06 · score 0.93

HOW TO USE IT

When pulling or pushing a theme, if no `--password` is provided and a cached store-auth session matches the target store, run the theme command without `--password` to use that session’s Admin API token. An explicit `--password` takes precedence. [Release note](https://github.com/Shopify/cli/releases/tag/4.4.0)

shopify theme pull --store <store.myshopify.com> --theme <theme-id-or-name>
shopify theme push --store <store.myshopify.com> --theme <theme-id-or-name>
shopify store auth --store <store.myshopify.com> --scopes <comma-separated-admin-api-scopes>

WHY THIS HELPS

Pull or push a theme for a store with a matching cached store-auth session and no theme password configured.

BEFORE THIS CHANGE

Authenticate theme commands through normal theme authentication; cached store-auth Admin API tokens were not used as a fallback.

REQUIREMENTS AND LIMITATIONS

  • Version: 4.4.0
  • --store <value>: Theme commands: target store URL; supply the store matching the cached session. Store auth: required; the store’s myshopify.com domain.
  • --theme <value>: Theme ID or remote theme name; use to select the target theme for a non-interactive command.
  • --password <value>: Theme Access password or Admin API token. The release note says an explicit value takes precedence over cached store auth.
  • --scopes <value> (required): Comma-separated Admin API scopes to request when creating the stored store-auth token.
  • Prerequisite: A cached `shopify store auth` session must match the target store for theme pull/push to use its Admin API token when `--password` is omitted.
  • Prerequisite: `shopify store auth` stores an online access token for later reuse; rerun it if the token is missing, expired, or lacks needed scopes.
  • The store-auth session must match the store.
  • An explicit `--password` takes precedence over the cached store-auth token.
  • Multi-environment theme configs can omit `password` when the matching store-auth cache session satisfies the requirement.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card