Shopify Deadlines 2026-2027: Script Tags, App Tokens and the Changes That Will Break Stores

On March 1, 2027, Shopify will stop loading script tags on storefronts. Any app or custom code that still relies on them will quietly stop working on your store that day.¹ Two months earlier, on January 1, 2027, every public app still using old-style access tokens gets pulled from the Shopify App Store.² And on November 2, 2026, three days from now, the Global Catalog REST API stops answering.³

None of this is new in the Fall '26 Edition. All of it lands in the four months after it. This is part three of our series on the Edition. The overview lists everything that shipped, and part two covers AI shopping agents. This one is the calendar: what breaks, when, how to tell whether your store is affected, and what developers need to do.

The short version

• March 1, 2027: script tags stop loading on storefronts. "Shopify will stop injecting script tags into storefronts." Since October 1, 2026, apps cannot create or update them on any API version.¹
• Shopify will not warn merchants in the admin. "We've decided not to show this banner for now," says Shopify's own documentation.¹ If you want to know, you have to check.
• Custom apps built in your admin have no replacement. They "can't use theme app extensions or web pixels." The script has to move into your theme.¹
• January 1, 2027: public apps on non-expiring tokens are delisted and blocked from new installs. Merchants see admin warnings from January 15. Their API calls return HTTP 403 from April 1, 2027.²
• November 2, 2026: the Global Catalog REST API "stops serving traffic."³
• January 16, 2027: API version 2026-01 becomes inaccessible, and apps still pinned to it are silently moved to a newer version.⁴
• The reaction from app developers is frustrated. Several report most of their merchants still on script tags, and no way to migrate them without each merchant clicking a button.

Every Shopify deadline on one page

Date	What happens	Who is affected
June 30, 2026 (passed)	All Shopify Scripts stopped running.5	Plus stores with checkout Scripts
August 26, 2026 (passed)	Script tags stopped running on the Order status page for non-Plus stores.6	Apps with order status scripts
October 1, 2026 (passed)	Apps can no longer create or update script tags, on any API version.1	Every app using script tags
October 16, 2026 (passed)	API version 2025-10 became unsupported.4	Apps pinned to 2025-10
October 22, 2026	Shopify Tax managed mode changes take effect.7	Apps that create markets or publish products
November 2, 2026	Global Catalog REST API stops serving traffic.3	Apps and agents searching Shopify Catalog via REST
January 1, 2027	Public apps on non-expiring offline tokens are delisted and blocked from new installs.2	Public App Store apps
January 15, 2027	Merchants see admin warnings about those apps.2	Merchants using non-compliant apps
January 15, 2027	The old Knowledge Base app is retired.8	Stores using it for AI agents
January 16, 2027	API version 2026-01 becomes inaccessible.4	Apps pinned to 2026-01
March 1, 2027	Shopify stops injecting script tags into storefronts.1	Any store still loading apps through script tags
April 1, 2027	Admin API calls with non-expiring offline tokens return HTTP 403.2	Public apps that did not migrate

What is a Shopify script tag, and why does March 1 matter?

A script tag is the old way an app adds JavaScript to your storefront. The app registers a script URL through Shopify's API, and Shopify injects it into every page. Reviews widgets, size charts, popups, chat bubbles, trust badges and tracking pixels have all used script tags for years.

Shopify has been retiring them in stages. They stopped running on the Order status page for Plus stores on August 28, 2025, and for all other stores on August 26, 2026.⁶ Since October 1, 2026, "You can't create or update script tags. Existing script tags keep running." On March 1, 2027, "Shopify will stop injecting script tags into storefronts."¹ Shopify's docs call storefronts "the last place script tags still run."

The replacement is an app embed block, part of a theme app extension, for anything that shows on the page, or a web pixel for tracking.¹ The catch is that an app embed has to be switched on by the merchant in the theme editor. The app cannot do it for you.

Is my store affected?

Probably, if your store is more than a few years old. One agency checked the live storefronts of its own client stores in September and found that "8 still load at least one app through a script tag, 27 scripts in total."⁹ That is a small, self-selected sample, but it matches what app developers report about their own user bases (see the reaction section below).

Why you might not find out until it breaks

Shopify had planned to warn merchants. Its documentation now says: "An earlier version of this plan included a banner warning app users who install an app that uses script tags. We've decided not to show this banner for now."¹ Shopify dropped the warning after developer pushback. Its explanation: many apps have leftover script tags on frozen or paused stores they cannot delete, "so the warning would have flagged apps that migrated off years ago."¹⁰

So there is no admin banner for storefront script tags. As Web Divine's Fady Ilias put it, "Most merchants have never heard of a script tag, which is exactly the problem."¹¹

How to check

1. List your apps. Open Settings > Apps and write down every app that shows something on your storefront or tracks visitors: reviews, upsells, popups, size charts, chat, analytics, affiliate tracking.
2. Check your theme editor. Open Online Store > Themes > Customize > App embeds. Apps that have already migrated appear here as toggles. An app you use that is not in this list is a candidate for a script tag.
3. Look at the page source. Open your storefront, view the page source, and search for asyncLoad. In most themes, the script URLs listed near it are the ones Shopify injects for apps through script tags. Note each domain and match it to an app.
4. Ask each vendor directly. The questions below take two minutes to send.
5. Find your custom code. Check Settings > Apps > Develop apps for custom apps someone built in your admin. Those are the riskiest, as the next section explains.

Questions to send your app vendors

• Does your app still use script tags on our storefront?
• If yes, when will your app embed block or web pixel be ready, and what do we need to turn on?
• Does your app embed work with our theme, including if it is a vintage (pre-Online Store 2.0) theme?
• Does your app use expiring offline access tokens, so it stays listed after January 1, 2027?

Tracking is the silent failure

Tripster Developers' Alex Ward made the point that matters most: "Losing a size chart is visible. Losing a tracking script is not."⁹ A missing widget gets noticed the same day. A missing conversion or affiliate tag looks like a slow month. If your marketing reports depend on a script-tag pixel, move it to a web pixel or a Customer Events custom pixel now, and compare numbers before and after. We covered server-side options in Shopify server-side tracking.

Custom apps built in your admin: the hardest case

If a developer built an app directly in your Shopify admin years ago, it has no clean upgrade path. Shopify's documentation is blunt: "Admin-created custom apps can't use app extensions, so they can't use theme app extensions or web pixels either." If you maintain it yourself, the advice is to "Move the script into the theme, using a custom Liquid block where possible, or the code editor if you need to."¹ If a third-party service had you create the app and paste in a token, that service has to release a real app.

There is a cost to editing the theme: Shopify notes that "editing theme code takes the theme off its automatic upgrade path, so only do this when the app can't use app extensions."¹

Tripster sums up the risk: "Nobody will send you an email about those. They need rebuilding as an app embed or a web pixel before March 1, 2027."⁹ Web Divine agrees that the risk "sits with apps that are no longer actively developed, custom apps someone built for you years ago, and setups nobody at the business remembers creating."¹¹ If you do not know what a custom app does, our Shopify app audit guide walks through how to find out without breaking anything.

January 1, 2027: the app token deadline

This one is for app developers, but merchants feel it too.

Every public app that calls the Admin API must switch from non-expiring offline access tokens to expiring ones. Shopify updated the enforcement timeline on October 27, 2026:²

• January 1, 2027: "Non-compliant apps are delisted from the Shopify App Store and blocked from new installs. Existing installations can continue making affected API requests until April 1."
• January 15, 2027: "Merchants using non-compliant apps see warnings in Shopify admin about the risk of service interruption and the action they can take."
• April 1, 2027: "Affected Admin API requests using non-expiring offline access tokens return HTTP 403."

"Custom apps and apps created by merchants are excluded."² Shopify is clear that the later dates are not a grace period: "January 1 is the migration deadline: The later dates give merchants time to prepare, and should not be treated as extra time to migrate."¹²

For merchants: if you see a warning in your admin after January 15 naming one of your apps, contact the developer immediately. After April 1, that app's background work, like syncing inventory or orders, stops.

How developers migrate

• Shopify app templates (Remix or React Router): turn on the expiringOfflineAccessTokens future flag in shopifyApp() and deploy.¹³
• Custom OAuth or token exchange: request expiring tokens, store the access token, the refresh token and both expiry times, refresh before expiry, and always save the newest refresh token.¹³
• Migrating without a merchant session: exchange the stored non-expiring token for an expiring one. This "permanently invalidates the old token," so make sure the new token is saved before you rely on it.¹³
• The new safety net: the October 27 update added client credentials (application-only) access, which lets an app mint a fresh token for an installed store without a stored refresh token.¹²
• Run the security check: shopify app security check flags common vulnerability patterns before release.¹²

November 2, 2026: the Global Catalog REST API shuts down

If you built an agent, comparison tool or app on Shopify's Global Catalog REST API, it stops working in three days. Shopify's changelog: "On November 2, 2026, the REST API stops serving traffic." Every request under discover.shopifyapps.com/global, including saved catalogs, fails after that date.³

The replacement is Global Catalog MCP, "which implements the Universal Commerce Protocol (UCP)."³ The REST search endpoint maps to search_catalog, the product endpoints map to get_product, and lookups map to lookup_catalog. Merchants are not affected directly. We covered what Shopify Catalog does for stores in part two.

API versions: what changes and when

Shopify releases a new API version every quarter. "Each stable version is supported for a minimum of 12 months."⁴

Version	Accessible until
2025-10	October 16, 2026 (now unsupported)
2026-01	January 16, 2027
2026-10	October 16, 2027 (latest stable)

When a version expires, "Shopify falls forward and responds using the oldest accessible stable version."⁴ Your app does not error. It silently starts getting responses shaped by a newer version, which is exactly how breaking changes reach production unnoticed.

Breaking changes in 2026-10 worth checking

• Changing the shipping address on an unfulfilled order now recalculates taxes for the new destination.
• Invalid metafield filters now return an error instead of being ignored.
• Customer segment queries move to MATCHES and NOT MATCHES, and named dates like 90_days_ago are deprecated.
• ProductVariant.barcode is deprecated in favor of a barcodes connection, since variants can now carry up to 20 barcodes.
• POS UI extensions lose staffMemberId, and POS cart mutations now reject changes POS does not confirm.¹⁴

Coming in 2027-01: owner_type becomes required on every metafield declaration in checkout and customer account UI extensions, and the metafieldInteger collection condition is removed in favor of metafieldInt.¹⁵¹⁶

Shopify Tax managed mode

Released October 28 and effective from October 22, managed mode lets Shopify control some store settings for US sales tax. For developers it is a breaking change "across all supported API versions, including unstable": marketCreate and marketUpdate now "reject attempts to override required currency and tax-display defaults for affected markets," and products published to the online store must also be published to Shop.⁷ On dated API versions, Shopify quietly corrects the request. On unstable, it fails.

How developers and merchants are reacting

The public reaction to these deadlines comes almost entirely from app developers, on Shopify's own developer forum. No trade press has covered them, and merchants mostly hear about them second-hand.

Script tags: "there's no programmatic way"

• Jeff Lyon, an app developer, asked in August: "Will there be a way to programmatically enable an app embed block for existing users? We have thousands of merchants using ScriptTags, and relying on each one to click a deep link from an email or return to the app dashboard feels daunting." Shopify's Misha Damjanic replied: "there's no programmatic way to enable them for existing users."¹⁰
• Another developer, Philo, got the deprecation email "with 6 days until the deadline" for October 1 and wrote: "It's like things are getting steadily worse when it comes to communication from Shopify."¹⁰
• Shopify partly walked back: "We heard you, and we're not shipping the install warning planned for October 1... Our email also made the warning sound much broader than it was. Both are on us. The rest of the timeline hasn't changed."¹⁰
• Vintage themes are a sore point. One developer has paying merchants "happily running on Legacy Themes, which do not support the new app blocks," and warned: "If you remove ScriptTags in March, you'll be breaking functionality for these live stores."¹⁰
• On October 27, the developer behind LAUNCHTIP posted: "we have 70-75% of our userbase on Script Tag. I'm not sure how many merchants we will be able to update to App Embed before the deadline."¹⁰

Tokens: security welcome, timing not

• Several developers asked for April instead of January. Nicholas Piasecki: "I encourage Shopify to consider delaying this until April 1st, 2027 instead of January 1st, 2027, so that we can all get through Q4."¹⁷ Shopify kept January 1 for delisting and pushed the hard cutoff to April 1 instead.
• He later migrated anyway, calling it "two weeks of work that I didn't exactly need piled on right now," adding that "our clients absolutely don't care about it and didn't notice the change."¹⁷
• Not everyone struggled. Another developer reported migrating "over 100000+ stores (inactive ones counted). This has worked flawlessly."¹⁷
• Shopify's Terence Tirella said it has "heard lots of feedback from developers who have dealt with the migration in a matter of hours with no problems." A developer replied that "being delisted is the same as having no extra-deadline. Nobody wants to get delisted."¹⁸
• The October 27 client credentials addition was welcomed: "Thanks so much for adding the client credentials flow! It seems like it eliminates the possibility of falling into an unrecoverable state."¹⁸

The bigger complaint: volume

Consultant Taylor Sicard counted the pace: "Shopify's developer changelog logged 791 entries in the two years to September 2026, and 153 of them carried the action-required tag. That is one forced change roughly every five days." On the token date: "The January 1, 2027 date lands right after peak season, and it now means delisting and no new installs."¹⁹

The common thread: developers accept the security reasons and the direction. What they object to is short notice, deadlines stacked around Black Friday, and migrations that depend on merchants who rarely open the app.

What to do now

If you run a Shopify store

1. Do the five-step check above and list every app that might use script tags.
2. Email your vendors this week with the four questions. Vendors who answer slowly now will answer more slowly in February.
3. Prioritize tracking scripts. Move analytics, ads and affiliate pixels to web pixels or Customer Events before Black Friday, so you have clean data through peak season.
4. Find any custom apps in Settings > Apps > Develop apps and get a developer to move or rebuild them before March 1, 2027.
5. Watch your admin from January 15 for warnings about apps on old tokens.

If you build Shopify apps

1. Ship app embeds and web pixels now and deep link merchants to the theme editor to turn them on. Delete script tags once the embed is active.
2. Migrate to expiring offline tokens before January 1, and use client credentials as a fallback.
3. Move off Global Catalog REST before November 2.
4. Pin to 2026-10 and test against the breaking changes above before 2026-01 falls away on January 16.
5. Run shopify app security check before every release.

If you would rather not untangle old apps, custom code and tracking yourself, our Shopify development team can audit your store's script tags and custom apps and give you a scoped plan within 48 hours.

Frequently asked questions

When do Shopify script tags stop working?

Shopify stops injecting script tags into storefronts on March 1, 2027. Apps have not been able to create or update script tags since October 1, 2026, on any API version, and script tags already stopped running on the Order status page in 2025 for Plus stores and on August 26, 2026 for all other stores.

Will Shopify warn me if my store uses script tags?

Not in the admin. Shopify planned a warning banner but its documentation now says "We've decided not to show this banner for now." Check your apps, your theme's App embeds list and your storefront page source, and ask your app vendors directly.

What replaces Shopify script tags?

App embed blocks in theme app extensions for anything that appears on the storefront, and web pixels for analytics and tracking. App embeds must be turned on by the merchant in the theme editor.

What happens to custom apps built in the Shopify admin?

Admin-created custom apps cannot use theme app extensions or web pixels, so they have no direct replacement for script tags. Shopify's guidance is to move the script into the theme with a custom Liquid block or the code editor, or have the service that requires the app release a real app.

What is the Shopify offline access token deadline?

Public apps that call the Admin API must use expiring offline access tokens by January 1, 2027. After that date, non-compliant apps are delisted and blocked from new installs. Merchants see warnings from January 15, and the old tokens return HTTP 403 from April 1, 2027. Custom and merchant-created apps are excluded.

What happens when a Shopify API version expires?

Shopify falls forward and answers using the oldest accessible stable version. Each version is supported for at least 12 months. Version 2025-10 became unsupported on October 16, 2026, and 2026-01 becomes inaccessible on January 16, 2027.

When does the Shopify Global Catalog REST API shut down?

The Global Catalog REST API stops serving traffic on November 2, 2026. Requests under discover.shopifyapps.com/global, including saved catalogs, fail after that date. The replacement is Global Catalog MCP, which implements the Universal Commerce Protocol.

Are Shopify Scripts still working?

No. Editing and publishing new Shopify Scripts stopped on April 15, 2026, and all Shopify Scripts stopped executing on June 30, 2026. The replacement is Shopify Functions.