If your store relies on apps from the Shopify App Store, some of them may stop being available to new stores on January 1, 2027, and could stop working on your store in April. Shopify is changing how public apps sign in to stores, and every public app that hasn't made the change by the deadline will be removed from the App Store.
What changed
On October 27, 2026, Shopify confirmed that every public app that reads or changes store data through the Admin API must switch to a more secure kind of access key, called an expiring offline access token, by January 1, 2027.
Until now, many apps have used access keys that never expire. Once an app was installed, its key stayed valid until the app was uninstalled or the developer reset its credentials, so a leaked key could be used for just as long.
The new keys work differently. According to Shopify's security documentation, an expiring key is only valid for one hour, and the app has to renew it regularly. A leaked key becomes useless quickly, which makes stolen credentials far less dangerous for your store.
Public apps created on or after April 1, 2026 already had to work this way. The October announcement extends the rule to every existing public app.
Extra protection Shopify added at the same time
In the same announcement, Shopify gave app developers new ways to protect stores:
- Recovering access without the merchant. If an app loses its renewal key, its server can now request a new one directly from Shopify instead of waiting for you to reopen the app.
- Locking access to known servers. Developers can now tell Shopify which server addresses their app uses. Requests from anywhere else are rejected, even if they carry a valid key.
- Declaring outside connections. Developers can list the outside services their app's code connects to on your storefront, checkout and admin pages, which helps Shopify spot requests the app didn't make.
- Developer identity checks. Shopify now verifies a developer's identity before their app can be installed on development stores and stores being built for a client.
- Security checks for developers. Shopify published a central set of security guides and automated checks that developers can run before each release.
Only the token change comes with a deadline for developers.
Who it affects
- Store owners using public apps from the Shopify App Store. If an app you depend on hasn't switched by the deadline, you will feel the effects even though you didn't do anything wrong.
- Developers and agencies that build or maintain public apps. They have to make the change.
- Not affected: custom apps built just for your store and apps you created yourself in your Shopify admin. The deadline only applies to public apps that use the Admin API.
What happens if an app isn't ready
Shopify has set out a clear sequence for public apps that haven't switched:
- From January 1, 2027, the app is removed from the Shopify App Store and no new stores can install it. If you already have it installed, it keeps working for now.
- From January 15, 2027, you will see a warning in your Shopify admin about any installed app that still hasn't switched.
- From April 1, 2027, Shopify starts rejecting the app's requests to your store data. In practice, the parts of the app that read or update your products, orders or customers may stop working.
Shopify has said the later dates exist to give store owners time to prepare, not to give developers more time. For developers, January 1 is the real deadline.
What to do now
If you run a Shopify store
- List the apps you rely on most. Focus on the ones that touch orders, inventory, fulfilment, subscriptions, reviews and email. Those are the ones that would hurt most if they stopped working.
- Ask each app's developer whether they've moved to expiring offline access tokens and whether they'll be ready before January 1, 2027. Using Shopify's own term makes it easy for their support team to give you a clear yes or no.
- Watch your admin from mid-January. If a warning appears for one of your apps, contact the developer straight away and start looking at alternatives.
- Plan a backup for critical apps. If a developer can't give you a date, find a replacement now, while you have time to test it, rather than in April.
- Check custom apps separately. Custom apps aren't covered by this deadline, but if an agency built yours, it's still worth asking them how its access is secured.
If you build or maintain public apps
- Check every public app you maintain, including older ones that don't get regular updates.
- Follow Shopify's migration guide. It covers apps built on Shopify's templates, apps that handle sign-in themselves, and how to move existing installs over without waiting for each merchant to open the app.
- Test on a development store before you release, including background jobs and webhooks, which use the app's access without a merchant in the app and need the new renewal handling.
- Review the new security options in Shopify's app security documentation once the migration is done.
Deadlines and dates
- April 1, 2026: new public apps created on or after this date must already use expiring tokens.
- October 27, 2026: Shopify announced the full timeline.
- January 1, 2027: deadline. Public apps that haven't switched are removed from the App Store and can't be installed on new stores.
- January 15, 2027: store owners start seeing warnings in the Shopify admin about apps that haven't switched.
- April 1, 2027: Shopify starts rejecting Admin API requests from apps that still use non-expiring keys.
Closing
For most store owners this should be a non-event, as long as the apps you depend on are ready in time. A few short emails to your app developers now can save you from a broken integration in April. If you maintain a public app and need help with the switch, or you want someone to check which of your store's apps could be affected, talk to Veriqo.