Shopify

Shopify Will Delist Public Apps Still Using Non-Expiring Tokens on January 1

Shopify's October 27 security update sets the enforcement path for public apps that still use non-expiring offline access tokens, with App Store delisting on January 1, 2027, merchant warnings on January 15 and HTTP 403 errors from April 1.

E-commerce 4 Internet Marketers Editorial

Older man in a cap holds out an hourglass charm to a young man with a laptop on a rainy cobblestone street at dusk.
On a rainy city street at dusk, an older man in a work coat holds out a key ring with a small hourglass charm to a young man carrying a laptop, a nod to Shopify's move to app tokens that expire after 60 minutes.

Shopify will remove public apps from the Shopify App Store and block new installs on January 1, 2027 if they still call the Admin API with offline access tokens that never expire. The company laid out the enforcement steps in an October 27 developer post, one week after it asked every app developer to take a set of security steps that same week.

Stores that already run an unmigrated app keep it after January 1. From January 15, merchants using such an app will see a warning in the Shopify admin, and from April 1, 2027, Shopify will answer Admin API requests made with non-expiring offline tokens with an HTTP 403 error. Shopify says the two later dates exist to give merchants time to prepare and “should not be treated as extra time to migrate.”

What an expiring offline token changes

An offline access token lets an app work with a store’s data when nobody from the store is logged in. Order syncs, recurring billing runs and webhook processing all depend on it. Shopify’s older offline tokens stayed valid until they were revoked. The expiring version lasts 60 minutes and is renewed with a refresh token, so a stolen token loses its value within the hour.

Shopify first announced the January 1, 2027 requirement in May, extending a rule that had applied to newly created public apps since April 1, 2026. It said merchants would not need to reinstall apps as part of the switch.

Why Shopify tightened the schedule in October

The October 20 post framed the push in blunt terms. Shopify wrote that attacks across app ecosystems were increasing “as AI gets better at finding vulnerabilities” and listed actions for developers, including a security scan through its AI Toolkit, two-step authentication on Partner, hosting, code repository and email accounts, a current emergency contact, and a review of Dev Dashboard logs filtered by client IP address. It said most partners in early access to the scan “found something they didn’t know about.”

Which apps the deadline covers

The requirement applies to public apps, as opposed to custom apps built for a single store, when they send GraphQL Admin API or REST Admin API requests. Shopify’s migration guide says custom apps, apps that merchants create in the Dev Dashboard or admin, and online access tokens fall outside the timeline. The guide also leaves out Payments Apps API requests, the interface payment gateway apps use to handle payment sessions in Shopify checkout.

Developers can find out where they stand in the Dev Dashboard logs by filtering for the token type “Offline, non-expiring,” according to the guide. For stores that rarely open an app, Shopify offers a direct migration flow that moves existing installations to expiring tokens without waiting for a merchant to open the app.

Why regulated stores should check their app list now

Merchants selling age-restricted or regulated goods on Shopify often depend on public apps for age verification, subscription billing and links to outside payment gateways. EC4IM covered how many of those same apps were caught up in earlier checkout extensibility deadlines.

If an app in that stack misses January 1, a store that already has it can keep using it, but a store adding it for the first time cannot. After April 1, Shopify will reject the app’s Admin API calls made with old tokens, and the migration guide says merchants lose access to the app until it re-authenticates. The Dev Dashboard log view belongs to the developer, so a store owner has to get the answer from the vendor. Questions worth putting to each app provider include the following.

  • Has the app moved to expiring offline access tokens, and if not, by what date will it?
  • Do background jobs such as recurring charges or order exports run on the new tokens for stores that seldom open the app?
  • If the app is delisted, what would moving its data and settings to a replacement involve?

Other security controls Shopify added

The October 27 post also introduced several tools for developers. An app that loses its refresh token can now request a new access token with client credentials signed by the app’s private key, without waiting for the merchant to open the app. An IP allowlist limits Admin API access to a developer’s own servers, and Shopify rejects requests from any other address even when the token is valid.

A new [network_access] section in the shopify.app.toml file declares the servers an app’s code talks to, which helps Shopify spot traffic the app did not send. Links to sites declared there can also skip the warning customers see before leaving a store. Shopify now verifies a developer’s identity before an app is installed on development and client-transfer stores, and it has published an app security hub along with a shopify app security check command for developers to run before each release.

The dates that matter for Shopify merchants

Shopify has given public app developers until January 1, 2027 to move to 60-minute offline tokens, with admin warnings to merchants beginning January 15 and outright API rejections on April 1. Custom apps, merchant-built apps and Payments Apps API requests are outside the rule. For stores whose age checks, subscriptions or gateway connections run through public apps, January 1 is the date to plan around, because that is when a lagging app leaves the App Store and finding a substitute becomes harder.

Sources