Shopify Offline Token Deadlines: Jan 1 Delisting, April 1 403s

November 2, 2026. Shopify has put dates on what happens to a public app that keeps using a non-expiring offline access token. In a developer changelog post of 27 October 2026, Shopify said the migration deadline stays at 1 January 2027 for "all public apps that call the Admin API," and shared what it calls an updated enforcement timeline for apps that miss it: on 1 January 2027 the app is "delisted from the Shopify App Store and blocked from new installs," on 15 January 2027 "merchants using the app see a warning in Shopify admin," and on 1 April 2027 "Admin API requests using non-expiring offline access tokens return HTTP 403." Shopify's own gloss is blunt: the later dates "give merchants time to prepare, and should not be treated as extra time to migrate." Custom apps, merchant-created apps and online access tokens are not affected. From today that is 60 days to the delisting date, 74 days to the merchant warning and 150 days to the hard failure. The same post shipped five new security features, including an IP allowlist for Admin API requests and a client-credentials path to obtain a new access token when a refresh token is lost. Here is what each date does and who has to act.

The three dates and what each one breaks

The changelog post opens by recalling that "on October 20, we asked all app devs to secure their app, and told you we'd share more before any security change takes effect." The enforcement timeline is the "more":

The first date hits the developer's revenue: no App Store listing and no new installs. The second hits the developer's reputation: the merchant sees a warning in admin. The third hits the merchant's store: whatever the app did through the Admin API with an old token, syncing inventory, tagging orders, pushing reviews, stops with a 403 error. Shopify's own sequencing line: "January 1 is the migration deadline: The later dates give merchants time to prepare, and should not be treated as extra time to migrate."

Who is affected and who is not

The rule covers "all public apps that call the Admin API." The post lists what is out of scope in one line: "Custom apps, merchant-created apps and online access tokens are not affected." So, in practice, a store's own custom integration keeps working with its current token, and apps that only use online tokens have nothing to change for this deadline. The migration target is "expiring offline access tokens," and Shopify points developers to its migration guide rather than restating the steps in the changelog.

Five security features that shipped with the dates

The same post says Shopify "rolled out several new features this week," and the first of them answers the main objection to expiring tokens:

1. Client credentials recovery. "If your app loses a refresh token, your backend can now request a new access token signed with your app's private key, without waiting for a merchant to reopen your app." That removes the main objection to expiring tokens, which is a background job dying when a token lapses with no merchant in session.
2. IP allowlist. "List the IP addresses your servers use, and we'll reject Admin API requests from any other IP, even if it has a valid access token." A leaked token becomes useless off your servers.
3. Network access declarations. A new [network_access] section of shopify.app.toml lists "the servers your app's code loads from or sends requests to, wherever it runs on a store," which Shopify uses "to spot requests your app didn't make," plus the sites you link customers to "so those links skip the warning customers normally see before leaving the store."
4. Identity verification. "We now verify your identity before installing apps on development and client-transfer stores."
5. An app security hub. "Every app security practice now has its own page in the dev docs," with the instruction to "run shopify app security check before every release."

The post closes with the line that sets the liability: if you suspect a security issue, "You are accountable to fix the problem and notify affected merchants."

What a merchant should do

1. List your public apps that touch orders, products, customers or inventory. Those typically work through the Admin API. Themes and storefront-only widgets are a different question.
2. Ask each vendor one question in writing: "Have you migrated to expiring offline access tokens?" A yes before 1 January 2027 keeps the app listed; a no means the April 403 is your problem too.
3. Treat a 15 January admin warning as a 76-day notice. From that warning to 1 April is the window to replace the app or get it fixed.
4. Do not confuse this with the Knowledge Base app change. That is a separate Shopify deadline, covered in Shopify Knowledge Base moves into admin.

What a developer should do

Migrate before 1 January, not before 1 April. Then use the new tools in the order Shopify listed them: turn on client credentials so a lapsed refresh token does not strand a merchant, add the IP allowlist, declare network access in shopify.app.toml, and run the security check in CI. Shopify says it uses the [network_access] list to spot requests your app did not make, so an incomplete declaration could make legitimate traffic look suspicious.

If your store depends on a public app whose developer has gone quiet, or you need a custom app built on expiring tokens with the allowlist and declarations in place, see our Shopify app service. For Google's AI Mode checkout work with Shopify, read Google AI Mode checkout for Shopify, and for the EU product identifier rule, EU product identifiers and customs.