Shopify public apps must adopt expiring offline tokens

Public Shopify apps using the Admin API must migrate to expiring offline access tokens before 1 January 2027. For merchants, the immediate task is to check whether their app providers are ready. For developers maintaining a public app, the requirement is to complete the migration before API access becomes restricted.

Shopify confirmed the timetable on 27 October 2026, alongside several new app security features. The January deadline is firm, although enforcement will take place in stages.

The three enforcement dates merchants need to know

Shopify has separated its response into App Store restrictions, merchant warnings and eventual API enforcement.

The dates are confirmed in the Shopify developer changelog and the official security update.

An app missing the January deadline will not automatically disappear from an existing store. Nor does the deadline mean the entire shop will stop working.

However, the later enforcement dates are not extensions to the migration deadline. Developers are expected to complete the work before January.

Store owners should audit their installed apps now

Start with the applications listed in your Shopify admin. Identify which ones are public apps and note the business processes they support.

Pay particular attention to integrations using the Admin API. An app responsible for inventory synchronisation or order management could disrupt those tasks if its API requests start failing.

Merchants are not expected to update access tokens themselves. The app developer is responsible for the migration, but store owners still need to establish whether their suppliers will comply.

Ask each relevant provider:

• Does the app use offline access tokens for the Admin API?
• Has the migration been completed, or when will it be finished?
• Which functions would be affected if the app failed to migrate?

Keep the answers in writing, particularly for integrations that support day-to-day operations.

It is worth checking supplier dependencies before enforcement begins. Leaving the assessment until a warning appears could make replacing an important integration more difficult.

Where a provider cannot confirm compliance, review possible alternatives and the dependencies involved in changing apps. The warning on 15 January should prompt action on an identified issue rather than trigger the first investigation.

A wider technology stack support calendar can help keep these checks organised.

Custom apps and online tokens are excluded

The new requirement is specifically aimed at public apps accessing the Admin API.

According to Shopify's developer announcement, custom apps, merchant-created apps and online access tokens are not affected.

Public apps created on or after 1 April 2026 were already required to use expiring offline tokens.

That distinction matters when reviewing an established store. Several apps may be connected to Shopify, but they will not necessarily share the same obligations.

For bespoke features such as a 3D product configurator, documenting the applications and external services involved makes it easier to identify dependencies.

Public app developers need to cover existing installations

For developers maintaining an existing public app, the change means moving away from non-expiring offline access tokens and adopting the expiring token model.

The official Shopify changelog directs developers to its migration documentation, covering token acquisition, existing installations, token storage and refresh handling.

Supporting new installations alone is not enough. Stores that already use the app must also be covered by the migration.

Before treating the work as complete, check that the necessary Admin API requests still succeed and that access recovery has been considered.

The purpose is to maintain the integration without leaving existing merchants dependent on credentials that Shopify will stop accepting.

New security controls are available for app developers

Shopify has also introduced several measures intended to improve application security. Its 27 October 2026 developer update identifies the following:

• IP allowlisting: restricts Admin API requests to approved server addresses. Requests from other IP addresses are rejected even when the access token is valid.
• Network access declarations: the [network_access] section in shopify.app.toml declares the servers and sites an app interacts with.
• Client credentials access: allows an app backend to recover access when a refresh token has been lost.
• Identity verification: applies before installing apps on development stores and client-transfer stores.
• Security checks: the shopify app security check command helps developers review security practices before releasing an update.

These controls should be assessed against the actual application infrastructure. For instance, introducing an IP allowlist requires knowing which servers legitimately communicate with the Admin API.

App maintenance is one part of running an online shop. Other responsibilities, including e-commerce accessibility requirements in Spain, also benefit from scheduled reviews.

This week, identify the public apps connected to your store and request confirmation of migration from their providers. If you maintain an app, review its token model and security controls. For help assessing an integration or building an alternative, tell Contrast 3D which application or business process needs reviewing.