Shopify will delist apps on non-expiring tokens from 1 January 2027

Shopify will delist apps on non-expiring tokens from 1 January 2027

27 October 2026: Shopify will remove public apps that still use non-expiring offline access tokens from its App Store on 1 January 2027, and block them from new installs. Its changelog of 27 October sets out penalties that build over three months, ending with the Admin API refusing those tokens with HTTP 403 from 1 April 2027.

Not yet independently verified. This rests on Shopify's developer changelog entry; we have not read the migration guide it links to, so we do not describe the migration steps in detail. We will update this when it can be confirmed, and remove this note.

The rule applies to existing public apps that were already covered by the 1 January deadline. Public apps created on or after 1 April 2026 must already use expiring tokens. Custom apps and apps created by merchants are excluded.

Three dates, three penalties

The enforcement timeline is now:

• 1 January 2027: non-compliant apps are delisted from the Shopify App Store and blocked from new installs. Existing installations can keep making the affected API calls until 1 April.
• 15 January 2027: merchants using non-compliant apps see warnings in the Shopify admin about the risk of service interruption and what they can do.
• 1 April 2027: Admin API requests that use non-expiring offline access tokens return HTTP 403.

The middle date is the one developers will feel commercially. Once merchants see a warning in their own admin, a developer who has not migrated will be fielding support tickets and cancellations before the API stops working.

Why Shopify wants tokens that expire

An offline token lets an app act on a store when the merchant is not present, for syncing orders, inventory or fulfilment overnight. A token that never expires is valuable to anyone who steals it from an app's database, because it keeps working until someone revokes it. Expiring tokens limit that window, at the cost of making the app refresh them.

To soften that cost, Shopify has added client credentials access. Using a request signed with the app's private key, the app's back end can obtain a fresh, short-lived access token without holding a refresh token. Shopify says this helps a back end recover access without waiting for the merchant to reopen the app, which has been a practical worry for apps whose refresh tokens lapse.

What developers and merchants should check

App developers should confirm which of their public apps still request non-expiring offline tokens, migrate token acquisition, convert existing installations, and test token storage and refresh handling, which is the sequence Shopify's changelog lists. Agencies that maintain custom apps for individual stores are not affected by this change.

Merchants who rely on a public app for back-office work can ask its developer now whether it has moved to expiring tokens, rather than wait for the warning in January. This follows other Shopify API changes this autumn, including the Global Catalog REST API shutdown on 2 November. Our catalogue lists 11 products in small business ecommerce software.

Sources

• Shopify developer changelog: Migrate to expiring offline access tokens before January 1, 2027, 27 October 2026