Playbook · Session token metafield missing
Shopify session token metafield missing? Prove idToken, authenticated fetch, and one Admin read.
Written for a Shopify DTC owner whose session token metafield is filled in Admin but returns null or missing when the embedded app fetches with a session token. Start with definition ownership, App Bridge idToken after ready, matching scopes, and one authenticated Admin read. This is not a webhook HMAC write blank, and it is not an offline ID token / permanent-token miss.
Nico at Latch AI Ops · Sep 17, 2026 · ~10 minute read
Buy the 72-hour install — $997Webhook HMAC fieldApp Bridge fieldMerchant FAQ
01
A missing session-token metafield is not automatically a blank App Bridge host.
Use this page when the embedded shell loads but metafield reads that depend on a session token return null, 401, or empty because the token was missing, expired, or attached too early. If the host UI is blank for other App Bridge context reasons after a good GraphQL read, use App Bridge metafield blank. If the miss is webhook-side HMAC before a write, use webhook HMAC metafield blank.
Do not reinstall yet. Capture the shop, app, resource GID, namespace.key, whether shopify.idToken() resolved, Authorization header presence (not the token value), scopes, and the exact Admin GraphQL selection.
02
Prove the owner resource, definition, and exact saved value.
Open Settings → Custom data and confirm the definition is owned by the resource the embedded page is viewing (Product, Shop, Order, or Customer). Record the exact namespace and key, for example ops.session_note, the type, and whether the app owns the definition.
Open that exact resource in Admin. Save a short unmistakable test value, refresh, and confirm it survives. A filled offline-token GraphiQL result with no session-token path is not proof the embedded fetch can return it.
03
Check idToken, exchange, and scopes together.
Session tokens come from App Bridge after the host is ready. Calling Admin GraphQL before idToken resolves, with a stale token, or without exchanging/authorizing per your app’s token flow yields empty metafields or auth errors. Confirm scopes match the resource (read_products, read_orders, or app-owned metafield access).
Prove the same query in Admin GraphiQL with a comparable Admin session. Select metafield(namespace: "…", key: "…") { value type }. Log field presence and HTTP status without logging the session token.
04
Trace one authenticated Admin metafield read.
Confirm the client waits for Bridge ready, obtains idToken, attaches Authorization, then selects the metafield on the correct owner GID. A fetch that uses an offline token path while you are debugging session tokens will mask the real miss — keep the auth surface named.
Keep the diagnosis distinct from offline ID token metafield missing and Admin GraphQL metafield missing. Those can look similar while using different auth or selection failures.
05
Retest one embedded page and keep a small proof packet.
Use one product (or shop) and one authenticated embedded Admin page. Record resource GID, namespace.key, type, saved test value, idToken resolved (yes/no), scopes, GraphiQL result, session-token fetch status, and whether the UI shows the test value. Hard-refresh only if GraphiQL succeeds and the session-token path still fails.
If the field is still missing, classify it as definition/value, missing/expired session token, fetch-before-ready, wrong owner GID, missing scope, or wrong selection. Do not call a full reinstall until one live embedded page proves idToken + metafield read together.
06
When to stay DIY vs pay $997.
Stay DIY when one idToken timing fix, scope grant, or selection check explains the miss. Keep the proof packet so future embedded hosts stay grounded in real session-token metafield reads.
Pay for the $997 one-time install when several Shopify surfaces, apps, catalogs, and ops alerts need to be wired and documented on one live store. Nico at Latch AI Ops can connect the agreed workflow in a 72-hour window after collaborator access. No earnings claim, conversion guarantee, or theme rebuild is included; owner passwords are not requested.