Shopify Legacy Custom Apps Deprecated: What to Do in 2026

For years, connecting a Shopify store to another system was simple: open the admin, create a custom app, pick the API scopes, and copy the access token into your ERP, warehouse, or automation tool. That route is closing. Shopify announced that starting January 1, 2026, you can no longer create new legacy custom apps from the Shopify admin.

If your store relies on one of these apps, don't panic. Here's what changed, what still works, and what to do next.

The short version

• Existing legacy custom apps keep working. Shopify's notice says the change "will not impact any existing apps", and their current access tokens stay valid.
• You can't create new ones in the admin. New custom apps are created in Shopify's Dev Dashboard or with the Shopify CLI.
• Authentication works differently. Dev Dashboard apps commonly use the client credentials grant, which issues tokens that expire after 24 hours. Your integration has to request new tokens automatically.
• No more copy-and-paste tokens. With the client credentials grant, you won't see a token in the Shopify admin at all.

What still works

Any custom app created in the admin before January 1, 2026 continues to run. Its scopes, webhooks, and access token are unaffected, and you can still manage it in Settings → Apps and sales channels.

The one thing to avoid is deleting a working legacy app. Once it's gone, it can't be recreated the old way, and you'll be rebuilding the integration under the new model on someone else's schedule.

What changed for new apps

New custom apps are created in the Dev Dashboard under your Shopify organization, configured with the scopes they need, released as a version, and then installed on the store.

The biggest practical difference is authentication. Instead of a permanent token copied from the admin, a Dev Dashboard app usually exchanges its client ID and client secret for a short-lived token:

• The client credentials grant only works when the app and the store belong to the same Shopify organization.
• Each token is valid for 24 hours, so your integration must request a fresh one before it expires.
• The scopes come from the app version you released, not from the token request.

Requesting and caching a token

Here is a minimal Node.js example. It requests a token, caches it, and refreshes it shortly before expiry:

let cached = null;

async function getAdminToken() {
  if (cached && cached.expiresAt > Date.now() + 60_000) return cached.token;

  const response = await fetch(`https://${process.env.SHOP}.myshopify.com/admin/oauth/access_token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "client_credentials",
      client_id: process.env.SHOPIFY_CLIENT_ID,
      client_secret: process.env.SHOPIFY_CLIENT_SECRET,
    }),
  });
  if (!response.ok) throw new Error(`Token request failed with status ${response.status}`);

  const { access_token, expires_in } = await response.json();
  cached = { token: access_token, expiresAt: Date.now() + expires_in * 1000 };
  return access_token;
}

Every Admin API request then sends the token in the X-Shopify-Access-Token header, exactly as before. Only the way the token is obtained has changed.

Dev Dashboard or Shopify CLI?

Most merchants replacing an admin-created custom app need the first row. A sync between Shopify and another system rarely needs any interface inside Shopify.

What this means for different setups

Merchants with a working integration. Nothing breaks today. Keep the app, but document it now: what it connects to, which scopes it has, which webhooks it uses, and who owns the credentials. That record is what makes a future rebuild quick.

Agencies and freelancers building for clients. The client credentials grant can't reach a store outside your own organization, including a client's store. For a client's store, the app has to be created in the client's organization, or it has to use the authorization code grant instead. Shopify staff have also confirmed that partners building a client transfer store can still create custom apps in the admin before the transfer. After the transfer, new apps go through the Dev Dashboard.

Tools that ask for an "Admin API access token". Older connectors and automation tools expect a token you paste in once. A 24-hour token breaks that model. Check whether your tool supports Dev Dashboard credentials, or put a small service in front of it that refreshes tokens.

A checklist for your store

1. List every custom app under Settings → Apps and sales channels → Develop apps.
2. Record each app's details: purpose, connected systems, scopes, webhooks, API version, and who holds the credentials.
3. Don't delete anything that still works.
4. Check API versions. Shopify supports each quarterly API version for at least 12 months, so an app pinned to an old version needs updating regardless of this change.
5. Plan rebuilds deliberately. Rebuild an app when it has a real reason to change, such as broad scopes, an unsupported API version, unclear ownership, or new requirements. The 2026 change alone isn't a reason.
6. For new integrations, create a Dev Dashboard app with the narrowest scopes, and build token refresh in from day one.

The bottom line

The change doesn't break existing stores. It changes how every new integration is built. Short-lived tokens are more secure than permanent ones pasted into third-party tools, but they need code that handles renewal. If your business depends on a custom integration, now is a good time to make sure you know exactly how it works, before you need to change it.