September 9, 2026. If your Shopify store runs a review widget, a popup, a chat bubble or a tracking pixel that an app installed for you, there is a fair chance it loads through a script tag. On October 1, three weeks from now, Shopify stops letting apps create or change those tags. On March 1, 2027, it stops running them at all. Nothing visibly breaks in the meantime, which is exactly why most stores will miss it.
What Shopify actually announced
The notice went up on the Shopify developer changelog on August 24, 2026, tagged both "Deprecation announcement" and "Action required". Five facts carry the whole story.
- October 1, 2026. The scriptTagCreate and scriptTagUpdate GraphQL mutations start returning a user error, and the REST ScriptTag resource rejects POST and PUT.
- March 1, 2027. Shopify stops injecting script tags into storefronts. That is the day things visibly stop working.
- Reading and deleting survive. The scriptTags query and the scriptTagDelete mutation keep working, so you can audit and clean up throughout.
- The storefront is the last holdout. Script tags already stopped running on the order status page under an earlier deprecation.
- Scope. The apps affected are those creating script tags with a display scope of online_store.
The escape hatch Shopify closed on purpose
Most Shopify breaking changes can be deferred. You pin the app to an older API version and buy a release cycle or two. Shopify shut that door in a single sentence: the deprecation "applies to all API versions, including older ones, so pinning won't defer it."
That is unusual enough to be worth saying plainly. There is no version of the Admin API, current or legacy, in which script tag creation still works after October 1. If your migration plan depended on staying on an old version until the new year, it is not a plan.
Five months when you can see it but not fix it
Read the two dates together and an odd window appears. Between October 1 and March 1, your existing script tags keep running, and you can list them and delete them, but you cannot create one and you cannot update one.
A script tag has exactly one field you would ever realistically want to change: the URL of the script it loads. From October 1 you cannot change it. So if the vendor behind one of those scripts moves its CDN, rotates a path or retires a file during those five months, the tag points at a dead URL and there is no supported way to repoint it. Delete and recreate is not a workaround, because create is blocked by the same change. The only remaining fix is the full migration, done in a hurry, in the middle of Q4.
Shopify does not spell that out. It follows directly from the two facts it does publish, and it is the strongest argument for treating October 1 as the real deadline rather than March 1.
The replacement is not silent, and that is the risk
Shopify names two replacements, and the difference between them is the part worth planning around.
The recommended path is an app embed block, shipped inside a theme app extension. Shopify's own configuration documentation is candid about the catch: app embed blocks are deactivated by default after an app is installed, and the merchant has to switch them on in the theme editor under Theme settings, then App embeds. An app can hand the merchant a deep link that activates the block for them, but somebody still has to click something.
The second path carries no such condition. Where a script only collects analytics or conversion data, Shopify says to use a web pixel instead, which in its words "needs no action from the app user."
So this is not a like for like swap. A script tag was invisible and automatic. Its recommended successor is visible and manual. Every app that migrates to an app embed block turns a silent install into a task on somebody's list, and the failure mode is quiet: the feature simply does not render, the merchant never sees an error, and the app takes the blame for a toggle nobody flipped.
Who is actually exposed
Two groups, and neither is the one people assume.
The first is stores on vintage themes. Shopify's REST reference states that script tags can only be used with vintage themes, and that any app which integrates with a theme and wants to be listed on the App Store must use theme app extensions instead. The store most likely to be running script tags today is the one that has not touched its theme in three years, which is also the store least likely to be reading a developer changelog.
The second is anyone carrying a custom or private app built in house or by a previous agency. A public App Store app has a vendor with a roadmap and a support inbox. The one off script somebody wrote to fire a pixel or inject a trust badge has neither, and because script tags are scoped to the app that created them, nobody inherits the problem automatically. It has to be found.
How to audit a store before October 1
- Inventory first. Run the scriptTags query. It survives the entire deprecation for exactly this reason, and it is the fastest complete list you can get. Every tag it returns is a decision you owe before March.
- Sort by what the script does. Analytics and conversion tracking go to a web pixel, and the merchant never has to know. Anything that renders on the page, a badge, a bar, a popup, a widget, needs an app embed block.
- Name an owner for each one. Public app, private app, or nobody. The third category is where the work hides.
- Ask your app vendors one question this month. Have you migrated off script tags, and will I need to activate anything. A vendor who cannot answer that in September is telling you something.
- Treat activation as a task, not a hope. If the fix is an app embed block, ship the deep link and keep a checklist of which stores have actually turned it on.
What it means for operators
The honest summary is that the work is small if you start now and genuinely unpleasant if you start in February. The create and update endpoints close in three weeks, and after that every option available to you is narrower than it is today.
There is a wider pattern here too, and it is the reason this keeps happening. Shopify has been moving app integration off free floating JavaScript and into declared, reviewable surfaces for years, first on the order status page, now on the storefront. The REST Admin API itself became a legacy API in October 2024, and since April 2025 new public apps have had to be built on the GraphQL Admin API. Every one of those steps traded a little developer convenience for a lot of merchant control. If your stack still leans on the old convenience, this deadline will not be the last one to find you.
For most stores the practical move this month is a half day of audit rather than a migration project. Pull the list, sort it, and find out which of your apps have already done the work. If you are choosing between apps that have and apps that have not, our Shopify app reviews are a reasonable place to start. If the audit turns up custom code with no owner, that is Shopify app development work, and it is the kind of job that is cheap in September and expensive in February.
Frequently Asked Questions
Creating and updating stops. Shopify's developer changelog states that from October 1, 2026 the scriptTagCreate and scriptTagUpdate mutations return a user error and the REST ScriptTag resource rejects POST and PUT. Existing script tags keep running normally until March 1, 2027. Reading them with the scriptTags query and removing them with scriptTagDelete continue to work throughout.
No. Shopify addressed that directly, stating the deprecation applies to all API versions, including older ones, so pinning will not defer it. This is different from most Shopify breaking changes, where staying on an older Admin API version buys you time. There is no version of the API in which script tag creation still works after October 1, 2026.
It depends on what the script does. Shopify's recommended replacement is an app embed block shipped in a theme app extension. If the script only collects analytics or conversion data, Shopify says to use a web pixel instead, which needs no action from the app user. The distinction matters because app embed blocks are deactivated by default and the merchant has to activate them in the theme editor.
Anything loaded by a script tag on your storefront will stop loading. Shopify stops injecting script tags into storefronts on that date, so widgets, popups, badges and pixels that depend on them simply stop appearing. There is usually no error message, which is why the failure is easy to miss until someone notices a missing feature or a gap in tracking data.
That already happened. Script tags stopped running on the order status page under an earlier, separate deprecation, and the March 1, 2027 date covers storefronts, which Shopify describes as the last place script tags still run. If you were affected by the order status change and worked around it, this is the second wave of the same shift.
Run the scriptTags query against your store through the Admin API, or ask your developer or agency to. Shopify deliberately kept that query and the scriptTagDelete mutation working through the whole deprecation so merchants and partners can audit and clean up. Script tags are scoped to the app that created them, so the results tell you which app owns each one.