Expiring offline access tokens required for all public apps as of January 1, 2027
UpdateUnverifiedAdded Sep 24, 2026
We're changing how public apps handle offline access tokens to enhance merchant data protection. Starting January 1, 2027, all public apps must use expiring offline access tokens when calling the Admin API. After that date, public apps still using non-expiring tokens will receive authentication errors.
Topics: Security, BI, Developer tools
More Shopify developer platform releases
Every Shopify developer platform release| Date | Release | Type |
|---|---|---|
| May 20 | Feature preview: Customer account improvementsunverified Preview | Preview |
| May 20 | Shop Minis March April 2026 updateunverified Update | Update |
| May 20 | Removing deprecated PRIVATE and PUBLIC_READ enums on metaobject definitionsunverified Deprecation | Deprecation |
| May 21 | Shopify CLI 4.0: SemVer, auto-updates, removing deprecated flags and commandsunverified Deprecation | Deprecation |
| May 18 | `shippingLine` field added to `FulfillmentOrderLineItem`unverified Update | Update |
| May 15 | New `checkoutToken` field added to the `Order` objectunverified Update | Update |
| May 27 | Next Generation Events now available in developer previewunverified Preview | Preview |
| May 13 | Function run log details are now automatically visible with the right access scopesunverified Update | Update |
Also shipped on May 20, 2026
Shopify in May 2026| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| May 20 |  Cloudflare | WAF - WAF Release - 2026-05-20unverified | Cloudflare developer platform | Beta |
| May 20 |  DigitalOcean | Request-based autoscaling for App Platform is now in general availabilityunverified | DigitalOcean | GA |
| May 20 |  Google DeepMind | Gemma 4.0.1unverified | Gemma | Update |
| May 20 |  DuckDB | DuckDB v1.5.3 Bugfix Releaseunverified | DuckDB | Update |
| May 20 | Cloudflare | DNS - New DNS records UX is rolling outunverified | Cloudflare developer platform | Update |
| May 20 | Cloudflare | Radar - Content type distribution and API traffic share on Cloudflare Radarunverified | Cloudflare developer platform | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.