--- title: Card deposit endpoint now requires mTLS certificate description: Shopify is requiring mTLS client certificates for its card-deposit endpoint starting October 15, 2026. Apps using the GraphQL Admin API vault mutations to... canonical: https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Card deposit endpoint now requires mTLS certificate | daily.dev og:description: Shopify is requiring mTLS client certificates for its card-deposit endpoint starting October 15, 2026. Apps using the GraphQL Admin API vault mutations to... og:url: https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf og:image: https://api.daily.dev/og/posts/QPg2m8GwF.png og:image:alt: Card deposit endpoint now requires mTLS certificate og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Card deposit endpoint now requires mTLS certificate **[Shopify Developer changelog](https://daily.dev/sources/shopifychangelog)** · 3 min read · 0 upvotes · 0 comments ## Summary Shopify is requiring mTLS client certificates for its card-deposit endpoint starting October 15, 2026. Apps using the GraphQL Admin API vault mutations to deposit cardholder data must obtain a Shopify-issued certificate and present it on every deposit call. Apps that only import payment method references from external gateways (Stripe, Braintree, etc.) are unaffected. To migrate, developers must request a certificate via email, configure it on their deposit calls, and set up rotation before the 1-year TTL expires using Shopify's Certificate Signing Service. Failure to migrate by the deadline will block new cardholder data deposits. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Shopify's card-deposit endpoint now require an mTLS client certificate? Yes, apps that deposit cardholder data through Shopify's /sessions card-deposit endpoint must present a Shopify-issued mTLS client certificate starting October 15, 2026. Previously no client certificate was required. The endpoint URL and the GraphQL Admin API vault mutations that consume the returned session identifier remain unchanged; only the deposit call itself needs the certificate. _Track breaking payment API changes like this mTLS rollout on daily.dev before they hit your integration._ ### How do I get a Shopify-issued mTLS certificate for the card-deposit endpoint? Email shopify-mtls-partnerships@shopify.com with your API client ID and technical point of contact. Shopify signs first certificates manually, which takes a few days, so requesting early is recommended. After the first certificate, rotation is self-serve through Shopify's Certificate Signing Service before the 1-year TTL expires, requiring no further involvement from Shopify. _Teams migrating payment integrations can follow rollout deadlines like this one on daily.dev._ ### Which apps are unaffected by Shopify's new mTLS requirement for card deposits? Apps that only import payment methods from external gateways such as Stripe, Braintree, Authorize.Net, Adyen, or PayPal, without depositing cardholder data to Shopify, are not affected and need no action. The requirement only applies to apps that call the deposit endpoint feeding the vault mutations used to store cardholder data directly at Shopify. _daily.dev helps developers scope which platform changes actually apply to their payment integration._ ## Similar posts on daily.dev - [Draft order deposit fields are now available in the GraphQL Admin API and Customer Account API](https://daily.dev/posts/draft-order-deposit-fields-are-now-available-in-the-graphql-admin-api-and-customer-account-api-p4bbot1u8) · Shopify Developer changelog · 0 upvotes · 0 comments - [Removal of payment method requirement on API created Subscription contracts](https://daily.dev/posts/removal-of-payment-method-requirement-on-api-created-subscription-contracts-bwkmk2kmt) · Shopify Developer changelog · 0 upvotes · 0 comments - [Built for Shopify requirements for Returns and exchanges apps and Subscription apps \(effective December 1, 2026\)](https://daily.dev/posts/built-for-shopify-requirements-for-returns-and-exchanges-apps-and-subscription-apps-effective-decem-n9m4unfee) · Shopify Developer changelog · 0 upvotes · 0 comments - [Helping businesses optimize network costs with the Visa Digital Commerce Authentication Program \(DCAP\)](https://daily.dev/posts/helping-businesses-optimize-network-costs-with-the-visa-digital-commerce-authentication-program-dca-isqy5d3wm) · Stripe · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#graphql](https://daily.dev/tags/graphql), [#shopify](https://daily.dev/tags/shopify), [#payment-processing](https://daily.dev/tags/payment-processing) [View this post on daily.dev](https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Card deposit endpoint now requires mTLS certificate","url":"https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf"},"datePublished":"2026-07-16T16:08:13.621Z","dateModified":"2026-09-13T20:04:34.407Z","description":"Shopify is requiring mTLS client certificates for its card-deposit endpoint starting October 15, 2026. Apps using the GraphQL Admin API vault mutations to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Shopify Developer changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Shopify Developer changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aefcb5d2c1ca4b45b5d2256b9e2a9cc3","url":"https://daily.dev/sources/shopifychangelog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,graphql,shopify,payment-processing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Shopify Developer changelog","item":"https://daily.dev/sources/shopifychangelog"},{"@type":"ListItem","position":3,"name":"Card deposit endpoint now requires mTLS certificate"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/card-deposit-endpoint-now-requires-mtls-certificate-qpg2m8gwf#faq","mainEntity":[{"@type":"Question","name":"Does Shopify's card-deposit endpoint now require an mTLS client certificate?","acceptedAnswer":{"@type":"Answer","text":"Yes, apps that deposit cardholder data through Shopify's /sessions card-deposit endpoint must present a Shopify-issued mTLS client certificate starting October 15, 2026. Previously no client certificate was required. The endpoint URL and the GraphQL Admin API vault mutations that consume the returned session identifier remain unchanged; only the deposit call itself needs the certificate. Track breaking payment API changes like this mTLS rollout on daily.dev before they hit your integration."}},{"@type":"Question","name":"How do I get a Shopify-issued mTLS certificate for the card-deposit endpoint?","acceptedAnswer":{"@type":"Answer","text":"Email shopify-mtls-partnerships@shopify.com with your API client ID and technical point of contact. Shopify signs first certificates manually, which takes a few days, so requesting early is recommended. After the first certificate, rotation is self-serve through Shopify's Certificate Signing Service before the 1-year TTL expires, requiring no further involvement from Shopify. Teams migrating payment integrations can follow rollout deadlines like this one on daily.dev."}},{"@type":"Question","name":"Which apps are unaffected by Shopify's new mTLS requirement for card deposits?","acceptedAnswer":{"@type":"Answer","text":"Apps that only import payment methods from external gateways such as Stripe, Braintree, Authorize.Net, Adyen, or PayPal, without depositing cardholder data to Shopify, are not affected and need no action. The requirement only applies to apps that call the deposit endpoint feeding the vault mutations used to store cardholder data directly at Shopify. daily.dev helps developers scope which platform changes actually apply to their payment integration."}}]} ```