Shopify is setting firm dates for apps to switch to a new kind of access key. Most of the work falls on app developers, but store owners will see some effects.
What changed
All public apps that call the Admin API must move to expiring offline access tokens by January 1, 2027. Offline tokens are the long-lived keys an app uses to read and change a store's data when the merchant is not logged in. If an app has not moved by the deadline, it is removed from the Shopify App Store and cannot be installed on new stores. Existing installs keep working for now.
Later steps follow. On January 15, 2027, merchants using an unmigrated app will see a warning in their Shopify admin. On April 1, 2027, requests that still use non-expiring tokens will fail with an HTTP 403 error.
January 1 is the migration deadline
Custom apps, apps you create for your own store and online access tokens are not affected.
Why it matters for your store
You do not need to change anything in your store today. Still, an app you rely on could be removed or show a warning if its developer does not finish the move in time. Shopify has also added security tools for developers, such as an IP allowlist and a list of the servers an app connects to. The IP allowlist rejects Admin API requests from IP addresses not on the list, and the server list lets an app declare the servers it loads from or sends requests to. The list can also name sites the app links customers to, so those links skip the warning customers normally see before leaving the store.
What to do this week
- Make a list of the apps your store uses.
- Ask each developer whether they have moved to expiring tokens by January 1, 2027.
- Plan a replacement for any app whose developer has no plan, so you are ready if it is removed.
Market Manager
Schedule bulk discounts with AI. Sales run on time and every original price comes back.
Written with AI from the source above. If something looks off, the source is what counts.
