Developer Changelog / Authentication & Required Action

Non-expiring offline tokens are being retired
Migrate to expiring tokens by January 1, 2027

Public apps that keep using non-expiring offline access tokens will be delisted from the App Store and can no longer be installed by new merchants. The new client credentials access lets your backend regain access on its own.

On this page
  1. What's changing (30-second overview)
  2. Penalty timeline (escalating enforcement)
  3. New feature: how client credentials access works
  4. Which apps are affected and which aren't
  5. Non-expiring vs. expiring compared
  6. 3-step migration guide
  7. 5 key points for developers
  8. 3 practical use cases
  9. One-line summary for proposals

1What's changing

Non-expiringoffline access tokens: public apps still using them must,by January 1, 2027, migrate toexpiringoffline access tokens. Otherwise,
they can no longer stay listed on the Shopify App Store or accept new installs.
∞

Before: non-expiring tokens

Once issued, an offline access token can be used indefinitely.

After: expiring tokens

Use expiring offline access tokens. On top of that, client credentials access lets your backend obtain new short-lived access tokens.

2Penalty timeline

1 January 1, 2027 Delisted from the App Store New installs blocked Existing installs keep working until April 1 2 January 15, 2027 In the merchant's admin, a warning is shown explaining the risk of suspension and the available actions 3 April 1, 2027 Affected Admin API requests HTTP 403 With non-expiring tokens Phased penalties (for apps that haven't migrated)
Nothing stops immediately on January 1, but new installs stop there. Existing installs keep working until April 1. After that, affected Admin API requests return 403.

3New: how client credentials access works

App backend No waiting on the merchant Request signed with the private key No refresh token needed Shopify Verify signature New short-lived access token Access restored
client credentials access : A way for your backend to regain access without waiting for the merchant to reopen the app.Using a request signed with the app's private key,without a refresh token,you can obtain a new short-lived access token.
The article doesn't specify token lifetimes, signing method, or endpoint details (see the migration guide).

4Which apps are affected / not affected

Covered by this schedule

Existing public apps

The new phased schedule applies to existing public apps that were originally subject to the January 1, 2027 deadline.

Still in effect

Public apps created on or after April 1, 2026

Requirements for these apps remain unchanged.

Not affected

Custom apps / merchant-created apps

Custom apps and merchant-created apps are not affected.

5Non-expiring vs. expiring tokens

ItemNon-expiring offline tokens (not migrated)Expiring offline tokens (migrated)
App Store listing Delisted from January 1 Remains listed
New installs Blocked from 1/1 Still accepted
Merchant admin Warnings shown from 1/15 Not specified (warnings apply only to apps that haven't migrated)
Affected Admin API requests HTTP 403 from 4/1 Still usable
Restoring access — client credentials access Fetch a new token with a request signed by your private key

63 steps from the migration guide

1

Update token acquisition

Rewrite your token acquisition logic to obtain expiring offline access tokens.

2

Migrate existing installs

Migrate stores that already have the app installed as well.

3

Verify storage and refresh handling

Confirm that token storage and refresh handling work correctly.

The article does not include specific API names, parameters, or code examples.Shopify's migration guideas you go.

75 key points for developers

1/1

1. The real deadline is January 1

Even though the API stops on 4/1, App Store delisting and the halt on new installs start on 1/1. Since new customer acquisition stops,plan around 1/1 as your deadline, not 4/1.

403

2. 403 responses after April 1

Affected Admin API requests using non-expiring tokens will return HTTP 403. The article doesn't specify exactly which endpoints are affected.

3. Private key management becomes a new requirement

Client credentials access usesrequests signed with your app's private key. Your backend needs to be designed to store the private key securely.

4. You can recover even without a refresh token

Your backend can obtain a new short-lived token on its own, without waiting for the merchant to reopen the app.It serves as a recovery path when a refresh fails.

5. Scope depends on app type

This phased schedule applies toexisting public apps. Requirements for public apps created on or after 2026/4/1 remain in effect.Custom apps and merchant-created apps are not affected. Sort the apps you handle by type first, then decide what needs to be done.

83 practical use cases for your business

2027 1/1 1/15 4/1
USE CASE 1

Public app developers: a migration project to stay listed on the App Store

Challenge
Your public app still uses non-expiring offline tokens. After 1/1, it will be delisted and new installs will stop.
Approach
Follow the migration guide and finish these steps before 1/1: ① update token acquisition → ② migrate existing installs → ③ verify token storage and refresh handling.
Impact
Your app stays listed on the App Store and keeps accepting new installs. You also avoid the warning in merchants' admin (from 1/15) and the 403 shutdown (from 4/1).
Tech notes
Migrating existing installs covers the tokens for stores already in production. Make sure you can track migration progress per store.
batch
USE CASE 2

Designing nightly batches, inventory sync, and other "merchant-absent" processes so they never stop

Challenge
With expiring tokens, a failed refresh could halt backend processing until the merchant reopens the app.
Approach
Build in client credentials access as a recovery path, fetching a new short-lived token with a request signed by your private key.
Impact
Access is restored without waiting for the merchant, so background processing keeps running.
Tech notes
Tokens can be obtained without a refresh token. Include private key storage and rotation procedures in your design (the article doesn't specify a particular method).
App inventory
USE CASE 3

Agencies and development partners: assessing the impact on client apps

Challenge
It's unclear which of the apps running on client stores are affected. From 1/15, merchants who see the admin warning may start sending inquiries.
Approach
Sort apps into "existing public apps / public apps created on or after 2026/4/1 / custom apps and merchant-created apps (not affected)" to map out the scope of impact.
Impact
You can tell clients early that unaffected apps need no action, and check the developer's status for affected public apps ahead of time.
Tech notes
Custom apps you've built in-house are not affected. For third-party public apps, check the developer's migration status.

9One-line summary for proposals

"Public apps that don't migrate to expiring offline tokens by January 1, 2027will be delisted from the App Store and stop accepting new installs,
and on April 1, the Admin API will return 403.With the new client credentials access, your backend can restore access on its own."