Why do we have to declare the scopes and api version on the ShopifyApp.configure if we already declare them on the .toml config file?

[BaggioGiacomo]

Overview/summary

That's my app shopify_app.rb file:

ShopifyApp.configure do |config|
  config.application_name = "Amplius"
  config.old_secret = ""
  config.scope = ""
  # Consult this page for more scope options: https://shopify.dev/api/usage/access-scopes
  config.embedded_app = true
  config.after_authenticate_job = false
  config.api_version = "2024-10"
  config.shop_session_repository = "Shop"

  config.reauth_on_access_scope_changes = true
  config.new_embedded_auth_strategy = true

  config.root_url = "/api"
  config.login_url = "/api/auth"
  config.login_callback_url = "/api/auth/callback"

  config.api_key = ENV.fetch("SHOPIFY_API_KEY", "").presence
  config.secret = ENV.fetch("SHOPIFY_API_SECRET", "").presence

  config.embedded_redirect_url = "/ExitIframe"

  if defined?(Rails::Server)
    unless config.api_key
      raise(
        "Missing SHOPIFY_API_KEY. See https://github.com/Shopify/shopify_app#requirements",
      )
    end
    unless config.secret
      raise(
        "Missing SHOPIFY_API_SECRET. See https://github.com/Shopify/shopify_app#requirements",
      )
    end
  end
end

Rails.application.config.after_initialize do
  if ShopifyApp.configuration.api_key.present? && ShopifyApp.configuration.secret.present?
    ShopifyAPI::Context.setup(
      api_key: ShopifyApp.configuration.api_key,
      api_secret_key: ShopifyApp.configuration.secret,
      api_version: ShopifyApp.configuration.api_version,
      host_name: URI(ENV.fetch("HOST", "")).host || "",
      scope: ShopifyApp.configuration.scope,
      is_private: !ENV.fetch("SHOPIFY_APP_PRIVATE_SHOP", "").empty?,
      is_embedded: ShopifyApp.configuration.embedded_app,
      logger: Rails.logger,
      log_level: :debug,
      private_shop: ENV.fetch("SHOPIFY_APP_PRIVATE_SHOP", nil),
      user_agent_prefix: "ShopifyApp/#{ShopifyApp::VERSION}",
    )
  end
end

Why do I need to set the config.scope and config.api_version if I already set them on the .toml config file?

[access_scopes]
scopes = "read_customers,read_discounts,read_themes,write_customers,write_themes"

[webhooks]
api_version = "2024-10"

Is there a way to avoid declaring them twice and just keep them on the .toml config file?

[Arkham]

Hi there, thanks for opening this issue. I believe your issue can be solved by following this step in the readme: https://github.com/Shopify/shopify_app?tab=readme-ov-file#new-embedded-app-authorization-strategy-token-exchange Let me know if it doesn't end up working for you.

[BaggioGiacomo]

Hi @Arkham !

Thanks for your response. I've already enabled the Shopify managed installation but I still have to define config.api_version, config.scope or the ShopifyAPI::Context.setup throws an error during Rails app startup.

If I remove config.api_version I get this error:

 Parameter 'api_version': Expected type String, got type NilClass

If I set config.api_version: "" I get this error:

ShopifyAPI::Errors::UnsupportedVersionError: Invalid version , supported versions: ["unstable", "2024-07", "2024-04", "2024-01", "2023-10", "2023-07", "2023-04",
"2023-01", "2022-10", "2022-07", "2022-04", "2022-01"

Let me know if I've explained myself well

[Arkham]

I see, and if you set the version as a valid one and the scopes using the ruby syntax, are they ignored?

[zzooeeyy]

Hi @BaggioGiacomo -

Sorry for this inconvenience, to further assist you:

1. api_version:

• config.api_version configured in your shopify_app.rb file is for specifying the admin API version when making queries to Shopify
• api_version configured in the .toml file is for specifying the webhook API version for when Shopify emits webhooks to your app

You can use different versions for these 2 configurations

2. scopes:

• The scopes configured and deployed from the .toml file should be the source of truth for your app
• The scopes configured in ShopifyApp is required for now since ShopifyAPI is expecting a strong type for this field and it can't be null
  • This is likely due to legacy OAuth flow dependencies, we can look into making that value optional

Let me know if you have more questions!

[BaggioGiacomo]

@zzooeeyy Ok, got it! Thank you!