Three Shopify deadlines land before the end of 2026, and two of them are this month. Public apps that run bulk operations need an IP allowlist by November 12, and every public app that calls the Admin API needs one by November 20 or it is delisted. Returns and subscription apps need Customer Account API sign-in by December 1 to keep Built for Shopify status. Public apps still on non-expiring offline tokens are delisted and blocked from new installs on January 1, and their Admin API calls start failing on April 1.
- Script tag creates and updates have failed since October 1. On March 1, 2027 script tags stop running on storefronts entirely, and pinning an older API version does not defer it.
- For most app teams the working deadline is the start of their BFCM code freeze. The two allowlist dates land in mid-November, when many teams are already frozen, so the config may have to ship before the freeze.
- At the November 5 Partner Town Hall, Shopify said network access rules will become required, every app submitter will need ID verification, and apps with no installs after six months will be removed. None of the three has a date yet. Merchants can now see in their admin whether each app has adopted expiring tokens, the IP allowlist and network access.
- Shopify App Pricing still has no forced migration date. The tool to move existing Billing API subscriptions is out, so this is the window to decide what you want to charge.
- Nov '26IP allowlists required
- Nov '26Partner tiers renamed
- Nov '26Partner Town Hall security asks
- Nov '26Global Catalog REST shut off
- Oct '26Offline token enforcement dated
Shopify's developer changelog logged 791 entries in the two years to September 2026, and 153 of them carried the action-required tag. That is one forced change roughly every five days, filed in the same feed as routine additions.
This tracker pulls out the changes with a date attached, the ones where doing nothing has a cost, and translates each into the questions a founder asks: who it hits, what breaks, and what to decide by when. Shopify documents how to make each change. It rarely says what the change does to your onboarding, your support queue or your pricing.
Every row links to the changelog entry or documentation page it came from. The dates are Shopify's. The impact and action columns are my read, as someone who helped build the Shopify Partner Program and later built and sold an app in this ecosystem.
If one of these deadlines touches your onboarding, billing or App Store placement, I can help you size the work and sequence it around peak season.
Which Shopify deadlines
land between now
and April 2027?
Read the date, then the "who it hits" column. If your app is not in that column, skip the row. The two API-version rows repeat every quarter; the rest are one-offs.
| Date | Change | Who it hits | If you do nothing | What to do |
|---|---|---|---|---|
| Nov 12, 2026 | IP allowlist required for public apps that use bulk operations | Public apps that run Admin API bulk queries or mutations | Bulk operations from the app fail after 11:59 PM ET | Turn on the IP allowlist in the Dev Dashboard. Serverless apps can allowlist by ASN |
| Nov 20, 2026 | IP allowlist required for every public app that calls the Admin API | All public apps, including unlisted ones. Custom-distribution apps and merchant-created apps are exempt | The app is delisted from the App Store, blocked from new installs, and flagged to merchants in Settings > Apps | Configure the allowlist. Apps that call the Admin API from merchant infrastructure can ask Shopify for an extension |
| Dec 1, 2026 | Built for Shopify: returns and subscription apps with buyer self-service must sign buyers in with the Customer Account API | Returns, exchanges and subscription apps that hold or want Built for Shopify status | At risk of losing Built for Shopify status | Integrate the Customer Account API in every buyer-facing flow |
| Jan 1, 2027 | Expiring offline access tokens required for all public apps | Every public app still on non-expiring offline tokens, including apps created before April 1, 2026 | The app is delisted from the App Store and new installs are blocked. Existing installs keep working until the April 1 cutoff below | Migrate to expiring offline tokens and build the refresh flow |
| Jan 1, 2027 | API 2027-01 released; metafield declarations in Checkout and Customer Account UI extensions need owner_type | Apps with those extensions that declare metafields | Deploys on 2027-01 or later are blocked | Add owner_type to each declaration in shopify.extension.toml; it already works on 2026-10 |
| Jan 1, 2027 | Shopify Partner Program moves to Silver, Gold, Platinum and Diamond tiers | Agencies and partners whose tier sets their support, co-marketing funds and Partner Directory listing | You land in whichever tier your attributed GMV and shop count qualify for. Select, Premier and Plus go away | Check your projected tier in the Dev Dashboard before January 1 |
| Jan 16, 2027 | API version 2026-01 stops being accessible | Apps still pinned to 2026-01 | Same fall-forward behaviour as the 2025-10 row | Stay within the two newest stable versions |
| Mar 1, 2027 | Shopify stops injecting script tags into storefronts | Merchants running older apps, and the apps themselves | Widgets and tracking loaded by script tags stop appearing, with no error on the storefront | Merchants: ask each app vendor whether it still uses script tags. Apps: finish the app embed migration |
| Apr 1, 2027 | Admin API calls with non-expiring offline tokens return 403 | Existing installs of public apps that missed January 1 | The app stops working for its merchants, who have seen a warning in their admin since January 15 | Finish the migration before January 1. Shopify says the later dates are not extra time |
| Apr 16, 2027 | API version 2026-04 stops being accessible | Apps still pinned to 2026-04 | Same fall-forward behaviour as the 2026-01 row | Stay within the two newest stable versions |
| No date yet | Network access rules in shopify.app.toml become required | Apps that load storefront assets, fetch data from other hosts, or send buyers to other domains | Nothing yet. Shopify said at the November 5 Partner Town Hall that it will become required, so merchants can lock their storefronts down with a content security policy | Declare your hosts now and test them on a dev store with the feature preview. Shopify is working on allowing more than 20 hosts |
| No date yet | ID verification for everyone who submits apps to the App Store | App developers submitting new apps | Nothing yet. Shopify announced it at the November 5 Partner Town Hall without a date | Expect an identity check in the submission flow. Partners who request collaborator access already go through one |
| No date yet | Apps with no installs after six months on the App Store are removed | Listed apps that have not had a single install in six months | The listing is removed | Check installs on every listing you keep live, and fix or pull the ones with none |
| No date yet | Billing API apps move to Shopify App Pricing | Apps billing merchants through the Billing API with manual plans | Nothing today; Shopify has not announced a forced migration date | The migration tool is out: subscriptions move at their next billing cycle, and merchants don't re-approve charges. Settle your plan structure before you move |
Source · Shopify developer changelog and API versioning docs, linked on every row
The API rows come from Shopify's API versioning page, which lists every stable version with its release date and the date it stops being accessible. The rest link to their own changelog entries.
Which Shopify changes
already took effect
in 2026?
These dates have passed, but most of them still shape a decision. The Scripts deprecation is the one merchants noticed, and Shopify Functions and checkout extensibility is where that logic runs now. The uninstall-reason change is the one founders should be reading every month, because it turned app churn into a labelled dataset. I wrote up how to diagnose app churn by root cause.
| Date | Change | Who it hit | Where it leaves you |
|---|---|---|---|
| Apr 1, 2026 | New public apps must use expiring offline access tokens | Apps created on or after that date | The January 1, 2027 deadline extends the same rule to every public app |
| Apr 15, 2026 | Shopify Scripts editing and publishing frozen ahead of the June 30 deprecation | Shopify Plus merchants on Scripts, and the agencies that wrote them | Discount, shipping and payment logic has to run as Shopify Functions or a public app |
| Apr 29, 2026 | Merchants must choose an uninstall reason before removing an app | Every App Store app | A new churn dataset in the Partner Dashboard; "Too expensive" and "Not working properly with store" are two of the eight options |
| May 12, 2026 | Shopify App Pricing launched: usage, recurring subscriptions, or both | Apps that bill through Shopify | The pricing surface every future billing migration moves toward |
| Jun 30, 2026 | Shopify Scripts deprecated | Plus merchants still relying on Scripts | Anything not moved to Functions or an app no longer runs |
| Jul 9, 2026 | Identity verification for Shopify Partners | Partners who request collaborator access to merchant stores | Optional at launch; Shopify said it becomes mandatory before new collaborator requests |
| Jul 15, 2026 | App Store requirement 4.1.2: use a unique name for your app | Apps with identical or copycat names | Enforced in audit waves, each with a set window to comply |
| Oct 1, 2026 | Script tag create and update blocked, on every API version | Apps that load storefront JavaScript through script tags | New installs can't receive a script tag. Existing ones keep running until the March 1, 2027 cutoff in Figure 1 |
| Oct 1, 2026 | API 2026-10 released; editing an unfulfilled order's shipping address now recalculates taxes | OMS, address-validation and support apps that call orderUpdate | Once you adopt 2026-10, re-read taxLines and totals after an address update |
| Oct 16, 2026 | API version 2025-10 stops being accessible | Apps that were pinned to 2025-10 | Their requests are now answered by 2026-01, the oldest supported version |
| Nov 2, 2026 | Global Catalog REST API stopped serving traffic | Apps and agents that called the Global Catalog REST endpoints | Requests fail, saved catalogs included. Global Catalog MCP, which implements UCP, replaces it |
Source · Shopify developer changelog and API versioning docs, linked on every row
What "do nothing"
costs, sorted by how
loudly it fails.
The rows fall into three kinds of failure, and they deserve different urgency.
Breaks. The script tag, offline token and bulk-operations allowlist rows stop your app working for real merchants. That shows up as support tickets first and uninstalls second. Since April every uninstall carries a reason, so "Not working properly with store" will tell you which deadline you missed.
Drifts. The API-version rows fail quietly. A request to a retired version is answered by the oldest supported one, so nothing errors. A field changes shape or a total recalculates, and you find out when a reconciliation does not add up.
Demotes. The Built for Shopify row does not break anything. It puts the badge at risk, and the badge is how Shopify decides which apps get featured placement in the App Store. For an app that acquires most installs through the store, losing it is a distribution problem. I wrote up what the badge is worth and what it costs to keep.
What should app teams
decide before the
BFCM code freeze?
1. Find every script tag call this week. Search your codebase for scriptTagCreate, scriptTagUpdate and the REST ScriptTag resource. Since October 1 those calls fail for new installs, so a merchant who installs your app today gets an app that half works. Existing installs keep running until March 1, 2027, which is why this one is easy to under-prioritise.
2. Put the token migration on the calendar before the freeze. The January 1, 2027 date lands right after peak season, and it now means delisting and no new installs. If your team freezes deploys in November, the migration has to ship before the freeze. The April 1 date for 403s is not extra time.
3. Decide your pricing before Shopify decides the migration date. Moving to Shopify App Pricing standardises how your plans are shown and billed. Until Shopify sets a date, you choose when to move, which makes now the time to fix a plan structure you would not choose again. My app pricing benchmarks and the pricing model tool are where I would start.
How do merchants find
the apps still loading
through script tags?
Script tags are how older apps add a reviews widget, a popup, chat or a tracking pixel without touching your theme code. After March 1, 2027 anything still loaded that way stops appearing, and nothing on the storefront will tell you. The replacement, an app embed, shows up in the theme editor under App embeds, where you switch it on.
The practical check: list the apps that put something visible or measurable on your storefront, and ask each vendor whether it still uses script tags. If the answer is yes and there is no migration date, that is a vendor risk worth pricing into your renewal. If you ran Shopify Scripts on Plus, the Scripts sunset guide covers what replaced them. Shopify retires its own apps on dates too: Stocky ended on August 31, 2026, and the Stocky end-of-life playbook covers what happens to your records.
What gets a row,
and where every
date comes from.
A change gets a row when it has a date and doing nothing has a consequence: something stops working, a status is at risk, or a decision gets made for you. New optional features do not get a row, however useful; those are in my Shopify Editions 2026 breakdown, which ranks both the Winter and Spring drops. Every date is taken from Shopify's own changelog or documentation and linked; nothing comes from secondhand coverage.
It is refreshed monthly against the changelog's action-required filter, and sooner when Shopify posts a dated change. It sits alongside the other trackers in The Index, including the Shopify app acquisitions tracker, and the wider ecosystem numbers live on the benchmarks page.
Questions app teams
ask about Shopify
platform deadlines.
Do Shopify public apps need an IP allowlist?
Yes. Public apps that use bulk operations must configure an IP allowlist by November 12, 2026, or their bulk queries and mutations fail. Every public app that calls the Admin API needs one by November 20, 2026. After that, apps without one are delisted from the App Store, blocked from new installs, and flagged to merchants in Settings > Apps. Apps on serverless hosting can allowlist by ASN, and apps that call the Admin API from merchant infrastructure can ask Shopify for an extension. Custom apps and apps a merchant creates in the Dev Dashboard or admin are not affected. Custom here means Shopify's custom distribution: an app installed on one store, or on stores in one Plus organization. An app an agency builds for one client and ships as an unlisted public app is still a public app, so it needs the allowlist.
When do Shopify script tags stop working?
In two steps. Since October 1, 2026, the scriptTagCreate and scriptTagUpdate mutations return an error and the REST ScriptTag resource rejects POST and PUT, on every API version. On March 1, 2027, Shopify stops injecting script tags into storefronts, so any JavaScript still loaded that way stops running. Shopify's replacement is an app embed block in a theme app extension.
Does pinning an older API version delay the script tag deprecation?
No. Shopify's changelog says the deprecation applies to all API versions, including older ones, so pinning will not defer it.
When do Shopify API versions stop working?
Shopify releases a version each quarter and supports each one for at least 12 months. Version 2025-10 stopped being accessible on October 16, 2026. 2026-01 is accessible until January 16, 2027 and 2026-04 until April 16, 2027. A request to a retired version is answered by the oldest supported version instead, so the response can change without an error.
What happens if my Shopify app still uses non-expiring offline access tokens after January 1, 2027?
On January 1, 2027 Shopify delists the app from the App Store and blocks new installs. Existing installs keep working, merchants see a warning in their admin from January 15, and from April 1, 2027 Admin API calls with non-expiring tokens return 403 errors. Shopify says the later dates are not extra time to migrate. Custom apps and apps a merchant creates in the Dev Dashboard or admin are not affected, but unlisted public apps still have to migrate.
Do I have to migrate my app to Shopify App Pricing?
Not yet. As of November 5, 2026 Shopify has not announced a forced migration date. Since late September, apps can move existing Billing API subscriptions: simple plans in one click from the Partner Dashboard, and usage-based or private plans with migration commands in the Shopify CLI nightly build. Each subscription moves at its next billing cycle without the merchant re-approving. This is the time to decide what you want to charge, before a date is set for you.
Which of these deadlines touches your roadmap?
I helped build the Shopify Partner Program and later sold my own app. If a platform change is about to hit your onboarding, your billing or your App Store placement, I can help you size it and sequence the work around peak season.
Start a conversation Model your app pricing →