Security update: Offline token dates, new security features
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on October 27, 2026.
This Shopify update is categorized as Action Required, Platform, Update.
What changed
On October 20, we asked all app devs to secure their app, and told you we'd share more before any security change takes effect. Here's what's new, and what you need to do. Offline access tokens The migration timeline for offline access tokens remains the same: All public apps that call the Admin API must migrate to expiring offline access tokens by January 1, 2027. We're sharing an updated enforcement timeline if an app isn't migrated by then: January 1, 2027: Delisted from the Shopify App Store and blocked from new installs. Existing installs keep working.
Who is affected
Shopify app developers using the API or platform feature named in this update should review the official change.
What action may be needed
Review the official Shopify entry and test the affected integration. Apply any required code or configuration changes before deploying.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →