[egaodd]

Closes shop/issues-develop#24215 · Part of shop/issues-develop#24007

TL;DR: The organization token variable is now SHOPIFY_SERVICE_ACCOUNT_TOKEN, the name agreed at the Organization Tokens sync. The old name never shipped, so this is a straight rename with no alias. Behavior is unchanged. Adds the changeset that announces the variable.

1. Rename to SHOPIFY_SERVICE_ACCOUNT_TOKEN ← this one
2. Never use saved logins in store info while the service account token is set #8899: store info / store open never use a saved login while the token is set
3. Report service_account_token as the auth method for the service account token #8900: telemetry reports service_account_token as the auth method
4. Deprecation warning for SHOPIFY_APP_AUTOMATION_TOKEN and SHOPIFY_CLI_PARTNERS_TOKEN

WHY are these changes introduced?

#8731 added SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN and noted that the name was waiting on a final call. Product and engineering have since settled on SHOPIFY_SERVICE_ACCOUNT_TOKEN.

stable/4.9 contains neither the old variable nor ensureNoOrganizationAutomationToken, and no changeset mentions them, so nobody outside main can depend on the old name. An alias would only add a second variable to document and later remove.

WHAT is this pull request doing?

• The variable. In private/node/constants.ts, the key organizationAutomationToken becomes serviceAccountToken, with value SHOPIFY_SERVICE_ACCOUNT_TOKEN. automation-token.ts reads it through that key, so the selection order (service account → app → Partner), the conflict rule and the empty-value rule are unchanged.
• The refusal helper. The public cli-kit function ensureNoOrganizationAutomationToken becomes ensureNoServiceAccountToken. Its error is built from the variable name, so it now reads "This command can't use SHOPIFY_SERVICE_ACCOUNT_TOKEN." Callers updated: ensureAuthenticated, store execute and store bulk (bulk-admin-context.ts, auth/admin-session.ts), and store graphiql.
• Words. Doc comments, test names and test fixtures say "service account token" instead of "organization automation token".
• Changeset (@shopify/cli-kit: minor). It announces the variable for organization list, store list, store create dev, store info, store delete and app commands. It also says the variable can't be combined with the app or Partner variables, and that commands needing your account or Admin API access refuse while it's set. Add SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN #8731 held this changeset back until launch. The backend denies the token until Organization Tokens is enabled, so exposing the variable now is safe.

Nothing else in the repo (docs, README, oclif.manifest.json) mentions the old name.

How to manually test your changes?

SHOPIFY_SERVICE_ACCOUNT_TOKEN=x SHOPIFY_APP_AUTOMATION_TOKEN=y shopify store list
SHOPIFY_SERVICE_ACCOUNT_TOKEN= shopify store list
SHOPIFY_SERVICE_ACCOUNT_TOKEN=x shopify store execute --store <store> --query "query { shop { name } }"
SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN=x SHOPIFY_APP_AUTOMATION_TOKEN=y shopify store list

1. "SHOPIFY_SERVICE_ACCOUNT_TOKEN can't be set together with SHOPIFY_APP_AUTOMATION_TOKEN."
2. "SHOPIFY_SERVICE_ACCOUNT_TOKEN is set but empty."
3. "This command can't use SHOPIFY_SERVICE_ACCOUNT_TOKEN."
4. No conflict error, because the old name is now ignored. The CLI uses the app token and fails at the exchange.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/private/node/constants.d.ts

@@ -8,7 +8,7 @@ export declare const environmentVariables: {
     env: string;
     noAnalytics: string;
     optOutInstrumentation: string;
-    organizationAutomationToken: string;
+    serviceAccountToken: string;
     appAutomationToken: string;
     partnersToken: string;
     runAsUser: string;

packages/cli-kit/dist/public/node/environment.d.ts

@@ -11,9 +11,9 @@
 export declare function getEnvironmentVariables(): NodeJS.ProcessEnv;
 /**
  * Returns the automation token the CLI authenticates with, from the first of these variables that is set:
- * SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN, SHOPIFY_APP_AUTOMATION_TOKEN, or the deprecated SHOPIFY_CLI_PARTNERS_TOKEN.
+ * SHOPIFY_SERVICE_ACCOUNT_TOKEN, SHOPIFY_APP_AUTOMATION_TOKEN, or the deprecated SHOPIFY_CLI_PARTNERS_TOKEN.
  *
- * Returns undefined when the variables can't be used (an empty value, or the organization variable set alongside
+ * Returns undefined when the variables can't be used (an empty value, or the service account variable set alongside
  * another one). Callers then fall back to the login flow, which reports the problem instead of logging in.
  *
  * @returns The automation token, or undefined if there is no usable one.

packages/cli-kit/dist/public/node/session.d.ts

@@ -148,15 +148,15 @@ export interface EnsureAuthenticatedBusinessPlatformOptions extends EnsureAuthen
  */
 export declare function ensureAuthenticatedBusinessPlatform(scopes?: BusinessPlatformScope[], options?: EnsureAuthenticatedBusinessPlatformOptions): Promise<string>;
 /**
- * Fails when SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN is set, for commands that can't run with that token.
+ * Fails when SHOPIFY_SERVICE_ACCOUNT_TOKEN is set, for commands that can't run with that token.
  *
- * Organization automation tokens can't log in as a user or call a store's Admin API, so commands that need either
+ * Service account tokens can't log in as a user or call a store's Admin API, so commands that need either
  * refuse to run instead of quietly using the person's own login. `ensureAuthenticated` runs this check before any
  * login. Commands that run on a login saved by `shopify store auth` call it before loading that login.
  *
- * @throws AbortError when SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN is set.
+ * @throws AbortError when SHOPIFY_SERVICE_ACCOUNT_TOKEN is set.
  */
-export declare function ensureNoOrganizationAutomationToken(): void;
+export declare function ensureNoServiceAccountToken(): void;
 /**
  * Logout from Shopify.
  *

packages/cli-kit/dist/private/node/session/automation-token.d.ts

@@ -4,7 +4,7 @@ interface AutomationTokenVariablesProblem {
 }
 /**
  * Returns the name of the automation token variable the CLI authenticates with: the first one that is set, in
- * the order SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN, SHOPIFY_APP_AUTOMATION_TOKEN, SHOPIFY_CLI_PARTNERS_TOKEN.
+ * the order SHOPIFY_SERVICE_ACCOUNT_TOKEN, SHOPIFY_APP_AUTOMATION_TOKEN, SHOPIFY_CLI_PARTNERS_TOKEN.
  *
  * A variable set to an empty string still counts as set, so `automationTokenVariablesProblem` can report it.
  *
@@ -16,7 +16,7 @@ export declare function automationTokenVariable(env?: NodeJS.ProcessEnv): string
  * Explains why the automation token variables can't be used, so a misconfigured environment fails instead of
  * falling back to the logged-in user.
  *
- * - SHOPIFY_ORGANIZATION_AUTOMATION_TOKEN can't be set together with SHOPIFY_APP_AUTOMATION_TOKEN or
+ * - SHOPIFY_SERVICE_ACCOUNT_TOKEN can't be set together with SHOPIFY_APP_AUTOMATION_TOKEN or
  *   SHOPIFY_CLI_PARTNERS_TOKEN.
  * - The selected variable can't be empty.
  *