Shopify sets a 2027 token deadline: ask app developers about existing installations

Shopify has set out what happens when public apps miss its migration deadline for expiring offline access tokens. Store owners should ask their app developers about existing installations now: an app can remain operational for a time after losing its App Store listing.

The October 27, 2026 developer notice requires affected public apps to migrate before January 1, 2027. This is an app authentication change, not a setting merchants can fix by editing their storefront. Custom apps and merchant-created apps are excluded.

Three dates, three different consequences

From January 1, 2027, non-compliant apps are delisted and blocked from new installations. Existing installations can continue making the affected API requests until April 1. On January 15, merchants using non-compliant apps start seeing warnings in Shopify admin about possible interruption.

On April 1, 2027, affected Admin API requests made with non-expiring offline tokens return HTTP 403. That is the operational cutoff for those requests. It does not mean every Shopify app stops working, nor that every feature of an affected app necessarily fails in the same way.

Shopify's companion security update explicitly says the later enforcement dates are not extra time to migrate. January remains the deadline. A merchant who waits for the January warning may have less time to investigate dependencies or arrange an alternative.

Ask about your installation, not just the next release

Create a short inventory of apps that support orders, inventory, fulfillment, subscriptions or digital delivery. For each, record the workflow it supports and the person responsible for it. Prioritize a dependency whose failure would stop a customer receiving something they have already bought.

Ask the developer whether the app uses the affected tokens, whether your existing installation has been migrated, and how they validated renewal and recovery. Request a completion date if work remains. A promise that new installations use the correct mechanism does not answer what happens to the installation already serving your store.

Shopify also describes client credentials access: a backend can use a request signed with the app's private key to obtain a fresh short-lived token without a refresh token. That gives developers another recovery mechanism. It does not remove the merchant's need to obtain a clear migration answer.

Check the business workflow after the change

Agree on a practical verification with the developer, such as confirming that an order reaches the system that fulfills it. Use an agreed test process, and avoid casually uninstalling a critical app as a diagnostic step. Reinstallation can introduce another change while you are trying to understand the first.

Keep token migration separate from the 2026-10 API shipping, inventory and order checks. Both matter, but passing one does not establish readiness for the other. Stores selling downloads should also review their digital product delivery checks. The question to close is whether the existing installation will keep completing its job after the enforcement dates.