--- title: Security update: Offline token dates, new security features description: Shopify confirmed its enforcement timeline for expiring offline access tokens and rolled out several new app security features. All public apps calling the... canonical: https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security update: Offline token dates, new security features | daily.dev og:description: Shopify confirmed its enforcement timeline for expiring offline access tokens and rolled out several new app security features. All public apps calling the... og:url: https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw og:image: https://api.daily.dev/og/posts/ufyAJkWaW.png og:image:alt: Security update: Offline token dates, new security features og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security update: Offline token dates, new security features **[Shopify Developer changelog](https://daily.dev/sources/shopifychangelog)** · 3 min read · 0 upvotes · 0 comments ## Summary Shopify confirmed its enforcement timeline for expiring offline access tokens and rolled out several new app security features. All public apps calling the Admin API must migrate to expiring offline access tokens by January 1, 2027, or face delisting; merchants see warnings on January 15, 2027; and non-expiring tokens get rejected with HTTP 403 starting April 1, 2027. New features include client credentials access to recover lost refresh tokens, an IP allowlist for Admin API requests, network access declarations in shopify.app.toml, identity verification before installs on development and client-transfer stores, and a new app security hub with a 'shopify app security check' CLI command. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do non-expiring offline access tokens stop working on Shopify's Admin API? Non-expiring offline access tokens start returning HTTP 403 errors on Admin API requests starting April 1, 2027. The migration deadline itself is January 1, 2027, after which apps are delisted from the Shopify App Store and blocked from new installs; merchants see a warning in Shopify admin starting January 15, 2027. Custom apps, merchant-created apps, and online access tokens are not affected. _Track Shopify's token migration deadlines on daily.dev so a missed date doesn't break your app in production._ ### How can my Shopify app recover from a lost refresh token without merchant interaction? Use the new client credentials access feature: your backend can request a new access token signed with your app's private key without waiting for a merchant to reopen the app. This is set up through Shopify's application-only access tokens flow, giving apps a way to recover API access programmatically after losing a refresh token. _Developers hardening Shopify app auth flows follow releases like this on daily.dev._ ### How do I restrict Shopify Admin API access to only my own servers? Set up an IP allowlist listing the IP addresses your servers use; Shopify rejects Admin API requests from any other IP address, even if that request carries a valid access token. This is configured through the new IP allowlist feature in the Shopify dev dashboard, announced alongside network access declarations in shopify.app.toml. _Teams locking down API access compare approaches like this one on daily.dev._ ## Similar posts on daily.dev - [Migrate to expiring offline access tokens before January 1, 2027](https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk) · Shopify Developer changelog · 0 upvotes · 0 comments - [Offline access tokens now support expiry and refresh](https://daily.dev/posts/offline-access-tokens-now-support-expiry-and-refresh-x4a6bm6ix) · Shopify Developer changelog · 0 upvotes · 0 comments - [More resilient refreshes for expiring offline access tokens](https://daily.dev/posts/more-resilient-refreshes-for-expiring-offline-access-tokens-sxnqsmpn3) · Shopify Developer changelog · 0 upvotes · 0 comments - [Shopify Lets You Script the Token, Not the App](https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt) · API Evangelist · 0 upvotes · 0 comments - [npm security update: Classic token creation disabled and granular token changes](https://daily.dev/posts/npm-security-update-classic-token-creation-disabled-and-granular-token-changes-ljsmxx0nk) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security update: Offline token dates, new security features","url":"https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw"},"datePublished":"2026-10-27T16:05:47.164Z","dateModified":"2026-10-27T17:06:15.234Z","description":"Shopify confirmed its enforcement timeline for expiring offline access tokens and rolled out several new app security features. All public apps calling the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Shopify Developer changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Shopify Developer changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aefcb5d2c1ca4b45b5d2256b9e2a9cc3","url":"https://daily.dev/sources/shopifychangelog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,oauth,shopify","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Shopify Developer changelog","item":"https://daily.dev/sources/shopifychangelog"},{"@type":"ListItem","position":3,"name":"Security update: Offline token dates, new security features"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-update-offline-token-dates-new-security-features-ufyajkwaw#faq","mainEntity":[{"@type":"Question","name":"When do non-expiring offline access tokens stop working on Shopify's Admin API?","acceptedAnswer":{"@type":"Answer","text":"Non-expiring offline access tokens start returning HTTP 403 errors on Admin API requests starting April 1, 2027. The migration deadline itself is January 1, 2027, after which apps are delisted from the Shopify App Store and blocked from new installs; merchants see a warning in Shopify admin starting January 15, 2027. Custom apps, merchant-created apps, and online access tokens are not affected. Track Shopify's token migration deadlines on daily.dev so a missed date doesn't break your app in production."}},{"@type":"Question","name":"How can my Shopify app recover from a lost refresh token without merchant interaction?","acceptedAnswer":{"@type":"Answer","text":"Use the new client credentials access feature: your backend can request a new access token signed with your app's private key without waiting for a merchant to reopen the app. This is set up through Shopify's application-only access tokens flow, giving apps a way to recover API access programmatically after losing a refresh token. Developers hardening Shopify app auth flows follow releases like this on daily.dev."}},{"@type":"Question","name":"How do I restrict Shopify Admin API access to only my own servers?","acceptedAnswer":{"@type":"Answer","text":"Set up an IP allowlist listing the IP addresses your servers use; Shopify rejects Admin API requests from any other IP address, even if that request carries a valid access token. This is configured through the new IP allowlist feature in the Shopify dev dashboard, announced alongside network access declarations in shopify.app.toml. Teams locking down API access compare approaches like this one on daily.dev."}}]} ```