Shopify custom apps after January 2026: legacy apps, Dev Dashboard tokens and what to do with your integrations

If you connect a script, a no-code workflow or a small integration to your Shopify store, you probably did it the old way: create an app in the admin, tick some scopes, copy the Admin API access token, paste it into the tool. Since 1 January 2026 that route is closed: Shopify legacy custom apps, the ones made in the admin, can no longer be created.

This guide is for store owners and operations people whose tools depend on those apps, and for anyone who needs a new connection and finds the old tutorials no longer match the screen. It covers what still works, how the replacement apps in the Dev Dashboard authenticate, how to move n8n workflows and scripts, and why this is a good moment to leave the REST API.

Everything here reflects Shopify's documentation and developer forum as of 15 October 2026; check the linked pages before you act.

What changed for Shopify legacy custom apps on 1 January 2026

Shopify announced it plainly: starting 1 January 2026, you can't create new legacy custom apps, and existing apps are not affected. Shopify's custom apps help page now says legacy custom apps created before that date are managed from the admin, and new custom apps are created and managed in the Dev Dashboard.

Who can do that matters if you work with a freelancer. Store owners have full access. Staff need the "App development > Develop" permission. Collaborator accounts, which many agencies use, cannot reach the Dev Dashboard at all, because they have no organisation-level permissions.

The other big change is the token. A legacy custom app showed you an Admin API token in the admin, and it never expired. A Dev Dashboard app does not show a token anywhere. Your code requests one.

What happens to your existing integrations

If one of your Shopify legacy custom apps is running today, leave it running. On Shopify's developer forum, staff confirmed in March 2026 that existing tokens remain valid. In April 2026 they added that there is no official path to convert a legacy custom app into a Dev Dashboard app, none on the immediate roadmap, and no deprecation of existing apps they knew of.

Three practical consequences:

• Do not delete or uninstall a working legacy app to tidy up. Its token dies with it, and you cannot create a replacement the old way.
• Some things are bound to the app. A fulfilment service location created by an app belongs to that app and cannot be transferred, so replacing the app means moving inventory and open orders.
• Old and new can sit side by side. A legacy app and a Dev Dashboard app can both be installed on the same store, so new features can go in a new app while the old one keeps doing its job.

What a legacy app does not escape is API versioning. Shopify releases a new version every quarter and supports each one for at least a year, so an untouched integration still needs updating.

How Dev Dashboard apps authenticate

There are three routes, and which one you need depends on whose app it is and where it runs:

Your situation	How the app gets a token	Token lifetime
Your own script or server, app created in your store's organisation	Client credentials grant	24 hours, then request a new one
A developer's app installed on your store from their organisation, running outside the admin	Custom distribution plus the authorization code grant	Offline token, kept until uninstall (staff forum guidance)
An app embedded in the Shopify admin	Custom distribution plus token exchange	Handled by Shopify CLI's app templates

Public apps have their own rule: according to a Shopify changelog post of 20 March 2026, new public apps created from 1 April 2026 must use expiring offline tokens, which stop working within 60 minutes if leaked. Custom apps, including ones made in the Dev Dashboard, are not affected by that rule.

Client credentials: handling 24-hour tokens properly

For most stores replacing a pasted token, the client credentials grant is the closest match. The steps:

1. In the Dev Dashboard, create an app in the same organisation as your store. A mismatch returns a shop_not_permitted error.
2. Select the access scopes on an app version, then install the app on the store. Changing scopes later means releasing a new version and approving it on the store.
3. Copy the client ID and client secret into environment variables or a secret manager, never into a file in your repository.
4. Your code posts them to the store's token endpoint and receives a token that lasts 24 hours.

POST https://{shop}.myshopify.com/admin/oauth/access_token
grant_type=client_credentials&client_id=…&client_secret=…

The response includes expires_in, always 86399 seconds. Send the token in the X-Shopify-Access-Token header. Shopify's own example caches it and refreshes about a minute before expiry rather than requesting one per call, and that is the pattern to copy. Alert someone on every failed refresh, because an integration that loses its token at night fails quietly.

The secret is now the thing to protect. Anyone with the client ID and secret can mint tokens, so rotate the secret when someone with access leaves.

Moving n8n, no-code tools and scripts off pasted tokens

This is where the change hurts most. Many tools were built around one permanent token pasted into a settings field. n8n's Shopify credential, for example, still offers an "Access token" option. A 24-hour token pasted there works for a day.

Your options, from best to last resort:

1. Use the tool's own Shopify app. If a connector offers an official app you install through OAuth, it handles tokens for you. That is usually the cleanest fix for a CRM, an email platform or a hosted automation tool.
2. Fetch the token inside the workflow. In n8n or a script, add an HTTP request at the start that exchanges the client ID and secret for a token, and pass it to the steps that follow. For a workflow that runs often, cache the token and reuse it until shortly before it expires.
3. Put a small relay in between. If a tool can only hold a fixed credential, a small service you control can keep the secret, refresh the token and forward the calls. It is more to maintain, so treat it as a bridge until the vendor supports OAuth.

On Shopify's developer forum, merchants with stores opened in 2026 have reported CRMs that could not work with 24-hour tokens while waiting on the vendor's App Store listing. If a tool you depend on has not published an OAuth app, ask the vendor for a date before you build around it. I compare no-code tools with custom code at real order volumes in Zapier, Make, n8n or custom code.

REST to GraphQL while you are in there

Most legacy integrations also use the REST Admin API. Shopify has treated REST as legacy since 1 October 2024, and new public apps have had to use only the GraphQL Admin API since 1 April 2025. At the time of writing, Shopify has published no shutdown date for REST in custom apps, so nothing breaks today.

Even so, rebuilding authentication is the natural moment to move, because you are already touching every call and testing every flow. GraphQL also brings bulk operations, which export large sets of orders or products as one file instead of thousands of paged requests, and rate limits measured in query cost, which reward asking only for the fields you need. A tiny, stable integration can wait. One you are rewriting should be written in GraphQL.

A migration checklist

1. List every custom app on the store and every outside tool holding a Shopify credential, with what it does and who relies on it.
2. Record each app's scopes, API version and REST or GraphQL use.
3. Keep working legacy apps running until their replacement has run cleanly for a while.
4. Create new apps in your own organisation, with only the scopes they need, so the code and access stay in your name.
5. Choose the grant from the table above, and write down where the secret lives.
6. Build refresh and alerting before going live, not after the first silent failure.
7. Move to GraphQL wherever you rewrite calls anyway.

The same year ended Shopify Scripts, which stopped running on 30 June 2026; Shopify Functions replaced them. I cover what Functions mean for the price of a custom app in what a custom Shopify app costs.

What it costs to replace a legacy integration

Start by checking whether you need custom code at all. An App Store app that does the job installs through OAuth and never touches a token. Shopify Flow covers many jobs that once needed a script.

When you do need your own app, the work is usually small: authentication, the calls the old integration made, rewritten in GraphQL, plus logging. On my Shopify app plans, the MVP, from $2,000, is a custom app for your store with one focused feature. The Flexible plan, from $4,500, adds admin screens and order and product data kept in sync, which suits a fuller integration. Both are starting prices; every project gets a fixed quote after a short brief, and the app lives in your organisation, not mine.

FAQ

Will my existing Shopify legacy custom app stop working?

Not because of the January 2026 change. Shopify said the change blocks only the creation of new legacy custom apps, and its staff confirmed on the developer forum that existing tokens remain valid. Your app still needs routine upkeep: Shopify releases an API version every quarter and supports each for at least a year. Do not uninstall a working legacy app, because you cannot create a replacement the same way.

Can I still get a permanent Admin API token for my own store?

Not by copying one from the admin. A Dev Dashboard app using the client credentials grant gets tokens that expire after 24 hours, so your code must request new ones. Shopify staff have said on the developer forum that an app installed through the authorization code grant receives an offline token that lasts until the app is uninstalled, but that route needs a web endpoint to receive the callback.

Can a freelancer create a custom app for my store as a collaborator?

No. Collaborator accounts cannot reach the Dev Dashboard, because they have no organisation-level permissions. Either you create the app and share the credentials securely, or you give the developer a staff account with the "App development > Develop" permission. Creating the app in your own organisation also keeps it in your name after the project ends, which is where it belongs.

If an integration on your store depends on an old token, or you need a new one built the current way, send me a short brief: what the integration does, which tools are involved, whether it uses REST or GraphQL, and what breaks if it stops. You can start from the Shopify app MVP plan, read about my Shopify app development service, or see what a custom Shopify app costs before you decide.