Shopify app security now belongs on your operational calendar. Shopify has confirmed that public apps calling the Admin API must migrate to expiring offline access tokens by January 1, 2027. Merchants don't usually control those tokens, but they depend on the jobs those tokens authorise. Here's how to check your providers' readiness, give your developers a useful brief, and avoid confusing an App Store deadline with an immediate shutdown.
Shopify app security: what changes in January 2027?
Shopify's October security update confirms the migration requirement and explains its staged enforcement. The scope matters: the stated deadline applies to public apps that call the Admin API. Don't assume every integration in your business has the same distribution model or migration obligation.
- January 1, 2027: non-compliant apps are delisted from the Shopify App Store and blocked from new installations. Existing installations keep working at this stage.
- January 15, 2027: merchants using affected apps see a warning in Shopify admin.
These are different consequences. An existing installation that continues to run in January isn't proof that its provider has completed the migration. Shopify's security announcement also sets out later enforcement; have your developer check the complete current schedule before they approve a release plan.
Our recommendation is to obtain evidence of readiness before the deadline, rather than waiting for an admin warning. Switching a business-critical app under pressure is rarely a tidy job, especially when its data must move with it.
What is an expiring offline access token?
An offline access token lets an app access Shopify's Admin API without a merchant actively using the app. Background work, such as a scheduled data sync, can depend on that access.
An expiring offline access token has a limited lifetime. The app must manage continued authorised access instead of assuming the same credential will work indefinitely. For merchants, the practical question is whether unattended work still runs when a credential expires.
Shopify's migration announcement also describes new client credentials access. A backend can use a request signed with the app's private key to obtain a fresh, short-lived access token without a refresh token. Shopify presents this as a way to recover access without waiting for a merchant to reopen the app.
That's useful, but the existence of a recovery mechanism doesn't prove an app has implemented it correctly. A successful login test tells you little about an overnight job. Ask developers to test the app while nobody has it open.
App comparisons need a security question
Fresh app-selection guides still tend to lead with features and price. AiTrillion's comparison, for example, places ratings, main functions and starting prices side by side. Those are useful discovery filters, although a vendor-written comparison isn't independent testing.
For an app that needs Admin API access, add another purchasing requirement: evidence that its provider can maintain access safely through Shopify's security changes. A long feature list doesn't answer that question. Neither does a high review score.
We wouldn't reject a provider because its migration work is still underway. We'd be concerned if it couldn't identify the affected authentication method or give a release and testing plan. A candid technical answer is worth more than a generic assurance that everything is handled.
This also changes procurement for a new store launch. An app already installed on an existing store may keep working at the first enforcement stage, while a new installation faces a different outcome. Confirm new-store readiness explicitly if expansion depends on the same app stack.
Build a Shopify app security readiness register
Start with integrations whose failure would interrupt operations. Put the fulfilment connector ahead of a decorative storefront widget. This is a continuity exercise, not an excuse to replace your entire stack.
Use a shared document with a named owner for each integration. Record:
- Business dependency: what stops or becomes inaccurate if the integration loses API access.
- Technical ownership: the provider or internal developer responsible for authentication.
- Applicability: whether the integration is a public app calling the Admin API, with confirmation from its owner.
- Migration evidence: the provider's written status, planned release and relevant test results.
- Fallback: the approved manual process or recovery route if background work pauses.
Keep uncertainty visible. “Awaiting provider confirmation” is a useful status. “Probably fine” isn't. Where an integration falls outside the stated public-app requirement, ask its developer which security rules do apply rather than treating it as exempt from all review.
Send providers a question they can answer
Does your app call the Shopify Admin API using offline access tokens, and does the January 2027 migration requirement apply? If so, please confirm your migration status, how background jobs recover access without a merchant opening the app, and what testing covers our existing installation and new installations.
Ask for the answer in writing and attach it to the integration record. Your operations team needs a support route and a fallback. It doesn't need access to private keys or raw tokens.
Give developers acceptance tests, not just a deadline
“Update authentication” is too vague for a business-critical integration. Agree on observable outcomes before the developer calls the work complete.
Test unattended work
Ask the developer to demonstrate a background operation after token expiry without opening the app to restore access. Choose an operation that matters to your store, such as an inventory sync. Confirm that it finishes and that failures reach someone who can act.
Test interrupted work
Authentication can fail during a job, not just before it starts. Ask what happens to partially processed work. Can it resume without creating duplicate records or skipping changes? This is our recommended acceptance criterion, not a claim that Shopify's announcement prescribes a particular retry design.
Test access recovery and key handling
If the app uses the newly announced private-key-signed recovery route, ask where that key lives and who can rotate it. Credentials should stay out of support tickets and screenshots. Have the developer document how the team recovers if signing credentials become unavailable or must be replaced.
For a third-party app, you may receive a provider's test summary rather than run these checks yourself. That's reasonable. Ask for evidence proportionate to the dependency; a critical warehouse connection deserves closer scrutiny than an optional feature.
IP allowlists add protection, but can also stop legitimate work
Shopify has also introduced Admin API IP allowlists. Developers can enter server addresses or CIDR ranges in the Dev Dashboard, test them against recent traffic, and enable enforcement. Shopify rejects GraphQL and REST Admin API requests from outside the permitted ranges with a 403 response.
Shopify strongly recommends this control for apps that call it from static IP addresses. Our view: it's worth evaluating alongside token migration, but don't enable it blindly. An incomplete allowlist can block legitimate workers just as effectively as unwanted traffic.
Have the developer account for production workers and recovery infrastructure before enforcement. If hosting uses changing outbound addresses, establish a supported networking approach first. Don't assume that an IP observed during a test will remain stable.
Ask developers to distinguish blocked-network requests from expired-token failures in their troubleshooting notes. Otherwise, the team may spend time replacing credentials when the actual problem is the request's origin.
Network access declarations solve a different problem
The new network access section in shopify.app.toml lets developers declare external hosts and servers. Declared navigation hosts can skip Shopify's external-navigation warning; server declarations help Shopify identify suspicious activity.
These declarations aren't interchangeable with token migration or an Admin API IP allowlist. Ask the developer to explain which control they're changing and why. For navigation hosts, approve only destinations the app genuinely needs. Removing a warning should follow a trust decision, not a desire to make every outbound link quieter.
Takeaways
- Public apps calling the Admin API must migrate to expiring offline access tokens by January 1, 2027.
- Initial delisting and blocked installations don't mean existing installations immediately stop working.
- Request provider evidence and test unattended work, especially for critical integrations.
- Review IP allowlists carefully, and treat network declarations as a separate control.
Sources
- Security update: Offline token dates, new security features
- Migrate to expiring offline access tokens before January 1, 2027
- Secure your app with network access rules in `shopify.app.toml`
- Restrict Admin API access with an IP allowlist
- 10 Best Shopify Apps to Boost Sales in 2026 - AiTrillion
Want this handled for you?
We're a Shopify Premier Partner and this is the work we do every day: performance, CRO, and store builds that pay for themselves. Book a free store review and we'll show you the three fixes we'd ship first.
Frequently asked questions
What is Shopify's deadline for expiring offline access tokens?
Public apps that call the Admin API must migrate by January 1, 2027. Shopify says non-compliant apps will be delisted and blocked from new installations at that stage, while existing installations keep working.
Will my existing Shopify apps stop working on January 1, 2027?
Not under the initial enforcement stage described in Shopify's announcement. Existing installations keep working at that stage, and affected merchants see an admin warning from January 15. Ask your provider about migration readiness and check Shopify's full schedule for later enforcement.
Do merchants need to replace Shopify app tokens themselves?
For third-party public apps, the app provider normally manages authentication. Merchants should confirm applicability and migration status with the provider. Internally maintained integrations need review by their responsible developer.
What does a Shopify Admin API IP allowlist do?
It restricts requests using an app's tokens to specified IP addresses or CIDR ranges. Shopify rejects requests from outside those ranges with a 403 response. Developers should test legitimate traffic before enabling enforcement.
