[aka-sacci-ccr]

What

vtex.masterdata.create now sends X-VTEX-API-AppKey / X-VTEX-API-AppToken whenever the client is configured with them, leaving the shopper's cookie out of that call.

Why

VTEX is rejecting anonymous writes to /api/dataentities. call() only attaches app credentials when no cookie is passed (so shopper-scoped calls like the orderForm never come back with unmasked profile data). A masterdata.create called with the shopper's cookie therefore went out without credentials and failed.

The create response is only Id / Href / DocumentId, so sending it as the app unmasks nothing. The "no credentials next to a cookie" rule still holds: when credentials are used, the cookie is dropped.

• With credentials: create always goes out as the app.
• Without credentials: unchanged, the cookie is forwarded as before.
• masterdata.search is unchanged.

Equivalent fix in deco-cx/apps: deco-cx/apps#1688

Note for sites

Sites need appKey / appToken with a role that has Dynamic Storage → Insert or update document. A site route or server function that exposes masterdata.create to the browser should pin the entity and whitelist fields, since writes now carry store credentials.

Testing

• New test in vtexClient.test.ts covering both cases (with and without credentials).
• apps-vtex tests (66), typecheck and biome pass.
• Not yet tested against a live VTEX account.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes vtex.masterdata.create so documents are written with store app credentials whenever they're configured, since VTEX now rejects anonymous writes to /api/dataentities.

Passing the shopper's cookie had made the client skip credentials, so those writes failed. With credentials configured, the call now goes out as the app and leaves the cookie out — safe because the create response only returns document IDs, nothing to unmask. Without credentials the behavior is unchanged, and masterdata.search is untouched.

Sites need an appKey/appToken with the Dynamic Storage → Insert or update document role. Any route or server function exposing masterdata.create to the browser should pin the entity and whitelist fields, because writes now carry store credentials.

^{Written for commit c750bc1. Summary will update on new commits.}

[github-actions]

🎉 This PR is included in version 8.5.2 🎉

The release is available on:

• blocks-v8.5.2
• GitHub release

Your semantic-release bot 📦🚀