Public apps still using non-expiring offline access tokens must migrate to use expiring offline access tokens before January 1, 2027 to remain listed in the Shopify App Store and continue accepting new installs.
New client credentials access helps your backend recover access without waiting for a merchant to reopen your app. Using a request signed with your app's private key, your backend can obtain a fresh, short-lived access token without a refresh token.
The enforcement timeline has been updated with incremental penalties for non-compliant apps:
- January 1, 2027: Non-compliant apps are delisted from the Shopify App Store and blocked from new installs. Existing installations can continue making affected API requests until April 1.
- January 15, 2027: Merchants using non-compliant apps see warnings in Shopify admin about the risk of service interruption and the action they can take.
- April 1, 2027: Affected Admin API requests using non-expiring offline access tokens return HTTP 403.
This schedule applies to existing public apps previously covered by the January 1, 2027 deadline. The requirement for public apps created on or after April 1, 2026 remains in effect. Custom apps and apps created by merchants are excluded.
Follow the migration guide to update token acquisition, migrate existing installations, and validate token storage and refresh handling.