Skip to main content

Security update: Offline token dates, new security features

Offline token enforcement dates, plus new security features: client credentials access, IP restrictions, network access declarations, identity verification, and a new app security hub.
Read the full story
Changelog
Subscribe

Surfaces & APIs

Versions

Change type

Latest 2026-10Release candidate 2027-01

  1. October 2026

    Surface
    1. UI extensions now support a larger number of locales
      Platform
    2. New trusted vault origin signal in Payments Apps API
      Payments Apps API
    3. Shop SDK lead capture now supports Rich Authorization Requests
      Tools
    4. Start Sidekick conversations from your app
      App Bridge
    5. Editions: Fall 2026
    6. Shopify App Pricing: Plan Feature Targeting
      App store
    7. Shopify App Store: Estimated local-currency prices
      App store
    8. Merchant email now available on the ThemeSale object in the Partners API
      Themes
    9. Introducing theme app add-ons: Build and bundle apps with your themes
      Shopify Theme Store
    10. Make your app's activity reportable in Shopify Analytics with App Events
      App Events API
    11. App Events: Send events from Checkout and Customer Account UI extensions
      App Events API
    12. Shopify Flow: manage automations through AI Toolkit
      API
    13. Managed mode for Shopify Tax
      Breaking changesAdmin REST API
    14. First sign-ins to customer accounts now set Customer.state and send customers/enable webhooks
      GraphQL Admin API
    15. Add selling plans to draft order line items with the Admin GraphQL API
      GraphQL Admin API
    16. Cart and checkout permalinks now support UCP at /buy
      UCP
    17. Store and app install details in the Dev Dashboard
      Dev Dashboard
    18. Manage payouts, billing, and settings in Dev Dashboard
      Dev Dashboard
    19. Migrate to expiring offline access tokens before January 1, 2027
      Action requiredPlatform
    20. Secure your app with network access rules in shopify.app.toml
      Platform
    21. Restrict Admin API access with an IP allowlist
      Dev Dashboard
    22. Promoted Placements beta now includes Shop Campaigns
      Catalog
    23. Search brands that don't sell on Shopify in the Catalog API (beta)
      Catalog
    24. Analytics queryable capability is configurable in shopify.app.toml for metaobject definitions
      API
    25. Unlink a customer's identity provider subject with the GraphQL Admin API
      GraphQL Admin API
    26. Discover a merchant's retail stores with UCP location search and lookup
      UCP
    27. POS UI extensions now support reactive storage access
      POS Extensions
    28. POS UI extensions 2026-10 adds s-pos-list, a virtualized list with custom row templates
      POS Extensions
    29. Polaris 2.0 is now stable
      Polaris
    30. Metaobject analytics queryable capability available in the Admin API
      GraphQL Admin API

    31. Securing your app, together

      Act now to secure your app: We're asking every app dev to act this week. We have new tools to help, including AI security scans, expiring tokens, and better log filtering. Read on to learn how.

      Platform
    32. Enable the analytics queryable capability on metafield and metaobject definitions from your app's TOML
      Tools
    33. Exclusive > timestamp filters exclude the full second
      GraphQL Admin API
    34. Checkout MCP and Cart MCP now support UCP buyer consent
      UCP

    35. Build with confidence: Shopify AI Toolkit's security check

      Check your app for security vulnerabilities with `shopify app security check`. Run it before you submit an app, and on every release, to catch problems in your own code and get remediation guidance.

      AI Toolkit

    36. Hydrogen 2026-10 is now available

      The new Hydrogen is now GA: A framework-agnostic JavaScript library to add Shopify commerce to your existing stack, plus skills for coding agents and starters for React Router and Next.js.

      Hydrogen
    37. Add shopping and Shop Pay checkout to any agent with Shop MCP
      Tools
    38. Cart updates that result in no changes to the cart no longer trigger carts/update webhooks
      Ajax API
    39. Detect when a POS extension screen finishes navigating
      POS Extensions
    40. Identify the published version running in a POS extension
      POS Extensions
    41. Global Catalog REST API stops serving traffic on November 2, 2026
      DeprecatedCatalog
    42. Catalog API now returns compare-at prices as list_price
      Catalog
    43. Hydrogen developer preview update: October 8, 2026
      Hydrogen
    44. New owner_type field for metafield declarations in Checkout and Customer Account UI extensions, required in 2027-01
      Action requiredCheckout UI
    45. Shopify Flow: Flow Trigger Lifecycle Callback extensions now support relative url paths
      Tools
    46. Cart mutations reject unconfirmed writes in POS UI extensions 2026-10
      Breaking changesPOS Extensions
    47. POS UI extensions now return percentage values for percentage discounts
      Breaking changesPOS Extensions
    48. Per-customer request limit for the Customer Account API
      Customer Account API
    49. Downgrade app access scopes from write to read
      GraphQL Admin API
    50. Hydrogen developer preview update: October 2, 2026
      Hydrogen
    51. What's new in Polaris 2.0.0-rc.1
      Polaris

    52. More control over commerce updates with Next Gen Events

      Fewer deliveries, richer payloads, no follow-up queries: Events is a declarative replacement for classic webhooks, now generally available across 18 topics.

      Events & webhooks
    53. New Shop Campaigns metrics and dimensions in ShopifyQL API version 2026-10
      ShopifyQL
    54. Rollouts queries and webhooks in the Admin GraphQL API
      GraphQL Admin API
    55. Discounts can now be included in Rollouts
      Action requiredGraphQL Admin API
    56. Orders webhooks now include selling_plan_id on line items
      Events & webhooks
    57. New fiscalDeviceIdentifier field on PointOfSaleDevice
      GraphQL Admin API
    58. metafieldInteger collection condition removed in API version 2027-01
      Breaking changesGraphQL Admin API
    59. Added parseWarnings to ShopifyqlQueryResponse
      GraphQL Admin API
    60. The orderCancel mutation now returns a structured jobResult
      GraphQL Admin API
    61. SMS marketing consent now available on the CustomerPhoneNumber object
      Action requiredGraphQL Admin API
    62. Tax webhook summary and calculation requests now use Global IDs
      Breaking changesGraphQL Admin API
    63. New SubscriptionContractCalculation API for subscription management
      Action requiredGraphQL Admin API
    64. Inventory shipment webhooks include inventory transfer IDs
      Events & webhooks
    65. Updated function syntax on the segment query language
      Breaking changesGraphQL Admin API
    66. Return policy profiles are now available in the GraphQL Admin API
      GraphQL Admin API
    67. New APIs for buyer-requested order edits
      GraphQL Admin API
    68. New tax fields for return shipping fees in the GraphQL Admin API
      GraphQL Admin API

    69. 2026-10: Release notes

      Covers order tax recalculation, metafield filter errors, and removed checkout fields.

  2. September 2026

    Surface
    1. Use app intents for your discount app
      Functions
    2. More resilient token exchanges when migrating tokens without a user session
      GraphQL Admin API
    3. Manage packed product dimensions with the GraphQL Admin API
      GraphQL Admin API
    4. Move existing subscriptions to Shopify App Pricing
      App store
    5. Sidekick can now invoke app intents without tools
      Platform
    6. WebMCP support for checkout
      Platform
    7. AI Toolkit skills have been consolidated to shopify
      Action requiredAI Toolkit

    8. The new Dev Dashboard: your command center for building

      One home for your apps and the stores you work in: Designed to make your everyday easier.

      Dev Dashboard
    9. Shopify Payments Balance Transaction GraphQL type supports currency conversion type
      GraphQL Admin API
    10. Polaris 2.0 release candidate
      Polaris
    11. Events subscription query complexity limit is changing to 100 points
      Breaking changesEvents & webhooks
    12. Polaris CDN 1.1 is now stable
      Polaris
    13. Removing marketCurrencySettingsUpdate mutation
      Breaking changesGraphQL Admin API
    14. Unlimited private plans and target stores in Shopify App Pricing
      App store
    15. New translatable boolean field for Metafield GraphQL Object
      GraphQL Admin API
    16. The automaticDiscounts query is removed in API version 2027-01
      Breaking changesGraphQL Admin API
    17. Request a bundle size exception for existing UI extensions
      Admin Extensions
    18. Adding a canceled receive action to the inventory shipments API
      GraphQL Admin API
    19. Removed session.currentSession.staffMemberId from POS UI Extensions (2026-10)
      Breaking changesPOS Extensions
    20. Purchase Order Read API
      GraphQL Admin API
    21. Query market hierarchies with the GraphQL Admin API
      GraphQL Admin API
    22. New Pricing audit trail for contextual product variant prices
      GraphQL Admin API
    23. Updates to Events payloads and subscription configuration
      Action requiredEvents & webhooks
    24. Filter Catalog search results by media type
      Catalog
    25. Dynamic complexity cost for metafieldsSet mutation
      GraphQL Admin API
    26. Prepare your app for the Shopify admin's new look
      Polaris
    27. family_name is optional for B2B orders in Payments Apps API requests
      Payments Apps API
    28. Delivery options in Shopify Functions input now expose their metafields
      Functions
    29. Hydrogen developer preview update: September 11, 2026
      Hydrogen
    30. Discounts Allocator Function API developer preview has ended
      Action requiredGraphQL Admin API
    31. Create and delete dev stores in Shopify CLI
      Shopify CLI