Shopify Offline Token Deadline: Store Owner Checklist
In short: Shopify has set dates for public apps still using non-expiring offline Admin API tokens: new installs blocked and delisting from 1 January 2027, merchant warnings from 15 January, and HTTP 403 errors on affected API calls from 1 April 2027. If product feeds, CRM syncs, attribution or fulfilment depend on an app, ask the vendor to confirm migration. Custom and merchant-created apps are outside this specific deadline.
- 1 January 2027: affected public apps can be delisted and blocked from new installs.
- 15 January 2027: merchants see warnings. 1 April 2027: affected Admin API requests return HTTP 403.
- Custom and merchant-created apps are not covered by this deadline.
- The 2025-10 API version stopped being accessible on 16 October 2026, and requests now fall forward to 2026-01.
The dates that matter
Shopify's 27 October 2026 security update adds concrete stages for public apps that still use non-expiring offline Admin API access tokens:
| Date | What happens |
|---|---|
| 1 January 2027 | New installs blocked and App Store delisting for affected apps |
| 15 January 2027 | Merchants see warnings |
| 1 April 2027 | Affected Admin API calls return HTTP 403 |
Shopify also announced client-credential recovery and IP and network access controls. On 20 October it asked app developers to run its AI Toolkit security check and begin moving to short-lived access tokens, and said expiring tokens will soon be required for all public apps.
Why a store owner should care
You may not use the term "offline token", but you probably use apps built on them. If an app breaks, your ads can keep spending while the data or operations behind them fail:
- Product feeds for Google Shopping, Meta catalogues and marketplaces
- Order and customer syncs to a CRM or email tool
- Reporting and attribution connectors
- Inventory, shipping and fulfilment tools
A checklist you can finish this week
- List your installed apps in Shopify admin and mark the ones that touch feeds, orders, customers, stock or tracking.
- Email each critical vendor and ask: "Have you migrated to expiring offline access tokens? By what date?" Keep the answers.
- Identify custom apps. Custom and merchant-created apps are outside this deadline, but have your developer review their access scopes and webhook security anyway.
- Replace abandoned apps. If a vendor does not reply, find an alternative before January.
- Set up monitoring. Add a simple check, such as daily order counts in your CRM versus Shopify, so a broken sync is caught in a day, not a month.
- Put the three dates in your calendar.
Also check your API versions
Shopify's version schedule shows the 2025-10 API version stopped being accessible at 15:00 UTC on 16 October 2026 (20:30 IST). Requests that still target it now fall forward to the oldest accessible stable version, 2026-01, instead of necessarily failing outright. Changed behaviour can still affect custom order, inventory, CRM or fulfilment integrations. Ask your developer to inspect API version headers and deprecated calls and to migrate to a tested supported version.
For agencies and brands we work with
We audit the connected apps and tracking behind every Shopify store we advertise for, because an unnoticed break in a feed or event can waste budget. If you would like the same check for your store, tell us about your store, or read about our Shopify and website development.
Sources
- App security updates, October 2026 · Shopify Developers
- Securing your app together · Shopify Developers
- API versioning · Shopify Developers
Facts in this article come from the sources above, checked on 28 October 2026. Platform features roll out in phases, so check your own account before acting. We update this page when official details change.