Quick answer: Shopify customer tags cannot be safely updated from theme Liquid or public storefront JavaScript. They belong to Shopify admin data, so the update must happen through an authenticated backend, Shopify Flow, or an app action with the proper Admin API access.
The real symptom
- A merchant wants a button or form to add a customer tag.
- Liquid can read some customer information but cannot save tags.
- A JavaScript Admin API call fails with CORS or authentication errors.
- The tag needs to drive segmentation, B2B access, or marketing logic.
Likely causes
- Liquid renders pages but does not write customer admin data.
- The Admin API cannot be exposed to the browser.
- Customer accounts do not grant arbitrary tag-write permission.
- New customer accounts and legacy accounts have different surfaces and constraints.
Correct patterns
- Use Shopify Flow when the tag can be triggered by an event such as account creation, order placement, or form app submission.
- Use an authenticated app backend when the customer performs a storefront action.
- Expose the storefront action through an app proxy only if the backend verifies the customer and request.
- Use Admin API customer tag mutations from the server side.
- Write an audit trail when tags control access or pricing.
Simple checks
- Never place Admin API tokens in theme JavaScript.
- Confirm whether the customer is logged in and authorized for the requested tag.
- Prefer a purpose-specific metafield or segment when a tag is overloaded.
Useful code or DevTools check
// Browser: call your app proxy
fetch("/apps/customer-preferences", { method: "POST" });
// Server: verify, then update customer tags with Admin APIDo not do this
Do not hide an Admin API token in Liquid, theme assets, or a custom pixel. It will be exposed to every visitor.