Skip to main content
Changelog
Subscribe

Surfaces & APIs

Security update: Offline token dates, new security features

Offline token enforcement dates, plus new security features: client credentials access, IP restrictions, network access declarations, identity verification, and a new app security hub.

On October 20, we asked all app devs to secure their app, and told you we'd share more before any security change takes effect. Here's what's new, and what you need to do.

Anchor to Offline access tokensOffline access tokens

The migration timeline for offline access tokens remains the same: All public apps that call the Admin API must migrate to expiring offline access tokens by January 1, 2027. We're sharing an updated enforcement timeline if an app isn't migrated by then:

  • January 1, 2027: Delisted from the Shopify App Store and blocked from new installs. Existing installs keep working.
  • January 15, 2027: Merchants using the app see a warning in Shopify admin.
  • April 1, 2027: Admin API requests using non-expiring offline access tokens return HTTP 403.

January 1 is the migration deadline: The later dates give merchants time to prepare, and should not be treated as extra time to migrate. Custom apps, merchant-created apps and online access tokens are not affected. Follow the migration guide.

Anchor to New security featuresNew security features

We've rolled out several new features this week to help secure your app:

  • Recover access with client credentials. If your app loses a refresh token, your backend can now request a new access token signed with your app's private key, without waiting for a merchant to reopen your app. Set up client credentials access.
  • Restrict API access to your own servers with an IP allowlist. List the IP addresses your servers use, and we'll reject Admin API requests from any other IP, even if it has a valid access token. Set up your IP allowlist.
  • Tell us which servers and sites your app uses. In the new [network_access] section of shopify.app.toml, list the servers your app's code loads from or sends requests to, wherever it runs on a store. We use that list to spot requests your app didn't make. You can also list the sites you link customers to, so those links skip the warning customers normally see before leaving the store. Declare your app's network access.
  • We now verify your identity before installing apps on development and client-transfer stores. This helps keep apps in trusted hands.
  • Use the new app security hub as your checklist. Every app security practice now has its own page in the dev docs. Point your agent at the hub to check which practices apply to your app, and run shopify app security check before every release. Go to the app security hub.

Anchor to Get helpGet help

If you ever suspect a security issue with your app, notify us immediately at partner-security-reports@shopify.com. You are accountable to fix the problem and notify affected merchants, and we'll support you through it.

For general security inquiries, contact Shopify Support.

Questions about these updates? Ask in the App Security board in the developer community.

Was this page helpful?