Shopify App development changes in 2026: Do existing Apps need to be Updated?
Shopify has introduced important changes to how apps are created and authenticated. This has led to some confusion, particularly around whether JavaScript is still supported, whether developers must now use PHP or Python, and whether existing Shopify apps will stop working.
The short answer is:
- JavaScript has not been replaced by PHP or Python.
- Existing legacy custom apps can continue working and do not currently have a mandatory migration deadline.
- New custom apps can no longer be created directly inside the Shopify admin as of January 1, 2026.
- Existing public apps using non-expiring offline access tokens must migrate before January 1, 2027.
What changed for Shopify custom apps on January 1, 2026?
Until the end of 2025, a merchant or developer could create a custom app directly from the Shopify admin, select the required API permissions and generate an Admin API access token.
From January 1, 2026, Shopify no longer allows new legacy custom apps to be created this way. New custom apps must instead be created through the Shopify Dev Dashboard, configured and then installed on the relevant store.
This is primarily a change to app creation, configuration and authentication. It is not the end of custom Shopify development.
The Dev Dashboard provides a more structured workflow, including:
- Centralised app and credential management
- Versioned app configuration
- Explicit API scopes and permissions
- Webhook API version management
- Installation management
- Logs, health metrics and app monitoring
For an API-only integration without an embedded admin interface, Shopify recommends creating the app through the Dev Dashboard. For apps with a richer interface, Shopify extensions or App Store distribution, Shopify CLI is generally the appropriate route.
Do new Shopify apps have to use PHP or Python instead of JavaScript?
No. Shopify has not made PHP or Python mandatory, and JavaScript remains fully supported.
Shopify’s recommended scaffold for many feature-rich apps currently uses Shopify CLI with a React Router template. This is a JavaScript/TypeScript-based development path, and the generated project handles much of the Shopify authentication flow.
At the same time, Shopify APIs are accessed through standard HTTPS and GraphQL requests. This means an app backend can be developed using JavaScript or TypeScript, PHP, Python, Ruby, Java, .NET or another suitable server-side technology.
The right language depends on factors such as:
- The app’s architecture and hosting environment
- The existing technology used by an ERP, PIM, CRM or warehouse system
- Whether the app needs an embedded Shopify admin interface
- The extensions or Shopify Functions required
- The development team’s experience
- Long-term maintenance and scalability
The important change is not the programming language. It is the authentication and app-management model.
How authentication works for new custom apps
Does a merchant need to reinstall a public app?
Which Shopify apps need action now?
Legacy custom app created before January 1, 2026
No migration required solely because of the 2026 change. Continue normal API, security and dependency maintenance.
New API-only custom app for stores in the same organisation
Keep working when built with the new flow.
Create it in the Dev Dashboard and implement the client credentials grant, including 24-hour token renewal.
New app with an embedded UI or Shopify extensions
Keep working when built with the new flow.
Shopify CLI and the recommended app template are usually the best starting point.
New public app
Use Shopify’s current authentication model and expiring offline access tokens from the beginning.
Existing public app using non-expiring offline access tokens
Keep working temporarily.
Migrate before January 1, 2027 to prevent Admin API authentication failures.
Custom app created by a merchant
Not affected by the January 2027 public-app token deadline.
A separate deadline for public Shopify apps: January 1, 2027
Shopify has also announced a second change that specifically affects public apps.
From January 1, 2027, all public apps making Admin API requests must use expiring offline access tokens. Public apps that continue sending non-expiring offline tokens after the deadline will receive authentication errors.
This requirement applies to public apps created before April 1, 2026 as well as newer public apps. It does not apply to custom apps or apps created by merchants in the Dev Dashboard or Shopify admin.
The new offline access tokens expire after 60 minutes and are accompanied by a refresh token. The app must therefore:
- Record the access token and its expiry time.
- Securely store the refresh token.
- Refresh the access token before it expires or after an appropriate authentication error.
- Atomically save the newly returned access-token and refresh-token pair.
- Provide a safe re-authentication path if a refresh token becomes invalid.
Apps built with Shopify’s current templates and official libraries already include much of the refresh handling. Older public apps or apps with a custom authentication implementation need to be audited and updated.
What we recommend
If your business relies on a custom Shopify integration, start with an audit rather than an automatic rebuild.
The audit should identify the app type, distribution model, authentication method, API versions, requested scopes, webhooks, extensions, data flows and external dependencies. From there, it is possible to determine whether the app needs no immediate changes, a focused authentication update or a broader architectural migration.
For public apps, the January 1, 2027 deadline should already be part of the development roadmap. Waiting until the final weeks creates unnecessary risk for merchants who depend on the app for orders, fulfilment, inventory, customer service or other essential workflows.
Build or update your Shopify APP with Us
Developing a Shopify app involves more than writing code. The architecture, permissions, authentication, merchant experience, privacy requirements, billing, extensions, testing and distribution model all affect whether the app will be secure, maintainable and accepted by Shopify.
At Blueant Solutions, we have hands-on experience developing both custom Shopify apps and public apps. We can support the complete process, from technical planning and API architecture to development, testing, deployment and submission to the Shopify App Store.
We also help businesses review existing apps, update authentication flows, build ERP and third-party integrations, develop Shopify extensions and prepare public apps for Shopify’s review process.
If you are planning a new Shopify app or need to determine whether an existing app must be updated, contact us here. We can review the current setup and recommend the safest and most efficient route forward.
- Custom and public Shopify app development.
- Authentication and token migration reviews.
- ERP, PIM, CRM, fulfilment and third-party integrations.
- App testing, deployment and Shopify App Store submission.
We usually reply within 1–2 business days.
