- All public apps must migrate to expiring offline access tokens by Jan 1 2027; after that non‑expiring tokens will be blocked and apps delisted from the App Store.
- New security features include client‑credential token recovery, IP‑allowlist enforcement for Admin API requests, network‑access declaration in shopify.app.toml, and an app security hub checklist.
- Follow the migration guide, update your app’s security settings, and contact Shopify security for any issues.