Shopify has set firm dates for public apps that still use non-expiring offline access tokens. Those apps must move to expiring tokens before January 1, 2027, or they lose their App Store listing. If your store relies on third-party apps, you should ask the vendors where they stand now, while there is time to switch.
What changed
Shopify posted the updated timeline in its developer changelog on October 27, 2026. An offline access token is the credential an app uses to keep working with your store's data when nobody is logged in. Shopify now requires public apps to use the expiring kind. The penalties arrive in steps:
- January 1, 2027: apps that have not migrated are delisted from the Shopify App Store and blocked from new installs. Stores that already have the app can keep using it until April 1.
- January 15, 2027: merchants who use a non-compliant app see warnings in the Shopify admin about the risk of service interruption.
- April 1, 2027: Admin API requests that still use non-expiring offline tokens return HTTP 403, which means Shopify refuses them.
The schedule applies to existing public apps that were already covered by the January 1 deadline. Public apps created on or after April 1, 2026 had to follow the rule from the start. Custom apps and apps created by merchants are excluded. Shopify also added a client credentials option, so an app's backend can get a fresh short-lived token without waiting for a merchant to reopen the app.
What it means for your business
If an app on your store has not migrated, nothing breaks on New Year's Day for stores that already have it installed. The risk comes later. After April 1, 2027, whatever the app does through Shopify's Admin API could fail, and you may see the warning banner in your admin from January 15. An app that has been delisted also tends to stop getting attention from its developer, so a missed deadline can be a sign the product is being left behind.
You cannot fix this yourself. The app's developer has to update how the app gets and stores tokens. What you control is how early you find out.
What to do now
- Open your Shopify admin and list every app installed on your store, including ones you rarely touch.
- Mark the ones you could not run your business without: inventory sync, shipping, reviews, email, subscriptions.
- Email those vendors and ask whether the app has moved to expiring offline access tokens, and by what date.
- Check the vendor's changelog or support page for a migration notice.
- If a vendor has no plan or does not answer, shortlist a replacement now and test it before the January 15 warnings reach your admin.
- Remove apps you no longer use. They add risk and nothing else.
The details
The migration guide linked from Shopify's changelog covers how developers change token acquisition, migrate existing installations and validate token storage and refresh handling. That work belongs to the app developer, not the store owner.
If you run a Shopify store and want a second opinion on which apps are worth keeping, our Shopify development team can review your setup. If you are also working on your store's shipping messages, see how to add an estimated delivery date on Shopify.