Can't install a custom app on a client's store? The collaborator and Dev Dashboard problem, explained
Short answer: collaborator access is store-level; creating and configuring apps is organization-level. Since the Shopify admin creation path closed on January 1, 2026, the "Develop apps" collaborator permission no longer leads anywhere, and an app built in your organization will refuse to install on a client store until you give it a custom-distribution install link. That link is the fix, and it takes about five minutes. Several other things people try — the client credentials grant, a staff account, a shared client secret — either fail outright or cost more than they save. This page maps all of them, including the ones that do not work.
What is the error, and what is it telling you?
Developers on Shopify's own forum report the text as:
"This app can't be installed on this store. [App name] can only be installed on stores that are part of the same organization." — as reported in February 2026
It is not a permissions failure and adding permissions will not clear it. It is Shopify saying the app currently has no route out of the organization that owns it. Every app lives in an organization; a store lives in the merchant's organization. The only sanctioned bridge between the two is a distribution method, and for a single merchant that method is custom distribution — Shopify's own definition is an app "you want to distribute to one store or multiple stores on the same Plus organization using a link."
Why doesn't the collaborator "Develop apps" permission help?
Because it governed a screen that no longer exists. That permission unlocked Settings → Apps and sales channels → Develop apps inside the merchant's admin, and Shopify's changelog is explicit that "Starting January 1, 2026, you can no longer create new custom apps in the Shopify admin."
The permission model underneath has not changed to compensate. Shopify documents Dev Dashboard user permissions and store collaborations as separate things from store staff permissions, and collaborator access to a store is not membership of that store's organization. So a partner who has done client work this way for years now finds the same collaborator account, the same store, and no path from one to the other. Agencies have asked Shopify for exactly this permission; in an April 2026 thread a Shopify staff reply described it as a feature request "we are aware of and considering" (thread). As of today it does not exist.
Which routes actually work?
Four routes are available, and they are genuinely different in cost and in what they leave you holding.
| Route | Works? | What it costs you | What you end up holding |
|---|---|---|---|
| App in your organization + custom distribution install link | Yes | One app per client store, created and maintained by you | Your own client ID/secret and an offline token on your server |
| Merchant creates the app in their organization | Yes | A walkthrough call per client; they own the app | A client ID and secret the merchant emails you, plus a 24-hour token refresh loop |
| You become a staff user on the client store | Partly | Usually means giving up the collaborator relationship | Store-level access; still no organization-level app management |
| Client credentials grant against the client store | No | — | Nothing; the organization requirement fails |
Route 1 — create the app in your organization and send an install link
This is the one Shopify staff describe in the same threads where the error is reported: create the app in your Dev Dashboard organization, click Select distribution method, choose Custom distribution, generate an install link for the client's store, and send that link to the client to install (February 2026 staff reply). The merchant clicks it, approves the scopes, and your app receives an offline access token through the authorization code grant.
Why this is the right default: the credentials live in your organization rather than in a merchant's inbox, the token is not on a 24-hour clock, and Shopify's API Terms §2.3.20 require one Custom Application per merchant anyway — so one app per client store is the compliant shape, not a compromise. The step-by-step version is in How to create a Shopify custom app in 2026.
The cost is real and worth stating plainly: it is one app per client store, forever. One configuration, one scope set, one credential set, one deploy per release, per store.
Route 2 — have the merchant create the app in their own organization
This works, and for some clients it is the right answer — the app then genuinely belongs to them. But price it honestly before you offer it. The merchant must create the app in their Dev Dashboard, set scopes in a config file, install it, and then hand you a client ID and client secret, because there is no access token in the UI any more: "With a client credentials grant, you won't see a token in the Shopify admin."
Three consequences follow:
- A secret changes hands. Shopify's own credential management guidance treats the client secret as something to protect. Asking a non-technical merchant to email you one is a security posture, and not a good one.
- You inherit a refresh loop. Client-credentials tokens are documented as "valid for 24 hours, after which they must be refreshed" (client credentials grant). Any product with a "paste your Admin API access token" settings field cannot hold that credential — this is an architectural break, not a copy problem.
- It costs a scheduled call. An agency described the unit cost precisely in April 2026: each integration with every client "now requires a video call with a step-by-step walkthrough to set up a new app in the dev dashboard, since we can't do this on a merchant's behalf" (thread). That is a calendar event per client per integration.
Route 3 — get added as a staff account
Sometimes proposed, rarely worth it. Shopify's guidance on working on client stores covers collaborator accounts as the partner-side mechanism, and practitioners report that mixing the two roles is awkward: in the same threads, agencies say holding a collaborator account and a staff account on the same store "causes all kinds of issues" and that the collaborator usually has to be removed first. Even after all that, a staff account is still store-level — it does not put you inside the merchant's organization, which is where apps are created. You pay the relationship cost and the original problem survives.
Route 4 — the client credentials grant (a dead end, and it's worth knowing why)
This is the workaround most often suggested in forum threads and it cannot work for partner-distributed apps. Shopify documents the grant as "only available for apps developed by your own organization and installed in stores that you own", and states separately that it "only works when the app and the store belong to the same Shopify organization" (client credentials grant, get API access tokens).
Your organization is not your client's organization. The grant is therefore available to a merchant acting on their own store (route 2), and to you on stores you own — never to you on a client's store. If you find yourself reading that documentation page for the fourth time hoping it says something else, it doesn't. Route 1 is the path.
One ambiguity, stated rather than glossed over: the same client-credentials page also says "Public or custom apps must use token exchange or authorization code grant," which reads as contradicting the Dev Dashboard page that tells you to use client credentials for an app in your own organization. The reading that reconciles them is that "custom" there means a custom-distribution app on someone else's store. Shopify does not disambiguate this in the docs we could find, so decide by the organization relationship, not by the app's label.
Where you are genuinely still stuck
Three things have no good answer today, and pretending otherwise would waste your time.
- There is no collaborator-level permission to manage apps in a client's Dev Dashboard. Agencies have asked for it by name; Shopify's public answer so far is that it is under consideration (April 2026 thread). Until it ships, route 2 always costs a human conversation.
- Partner-side tooling against a client store hits the organization boundary too. One agency reported wanting to run a bulk export against a client store where its extension-heavy app is installed, and hitting "the org permissions error" when trying to use the CLI's execute command (thread). The app being installed on the store does not make the store part of your organization.
- A merchant with no technical capacity is a genuine blocker on route 2. If they cannot create an app, edit a config file, and produce a client secret, route 2 is not available to them at all — and route 1 becomes the only option, which means you carry the app.
There is also a workaround genre circulating in these threads that we would not recommend and will not detail: scaffolding a local app, disabling token expiry, and extracting session tokens directly from a development database. People are doing it because they are stuck; it multiplies exactly the long-lived-secret problem that the January 2026 change was meant to reduce.
So what is the actual recommendation?
If you serve client stores and you are hitting this error: create the app in your own organization, select custom distribution, send the install link. It is Shopify's prescribed path, it is what the API Terms require, and it leaves the credentials somewhere you control. For one or a few clients that is the whole job.
Above a few, it repeats — a new app, config, scope set, credential set and per-release deploy for every client store. Shopify staff acknowledge that ceiling in the same breath as the prescription: one 2026 reply describing one app per client store adds "it's a bit more setup up front, but for a handful of stores it's manageable" (thread, April 2026). The wider decision tree, including when a public app is the better answer, is in How to install a Shopify app on multiple stores.
Where DeploTeka fits (product note). DeploTeka is our own tool for the repeating case, and this is the only place it appears in this guide. It creates a dedicated custom-distribution Shopify app per client store inside your own organization, seals the credentials and delivers them to your backend, and pauses with a named action when a step needs a person. It does not clone, build, or run your source on our servers, and the merchant still approves each install — Shopify requires that, and no tool removes it. deploteka.com
Sources: [Shopify changelog — legacy custom apps can't be created after January 1, 2026](https://changelog.shopify.com/posts/legacy-custom-apps-can-t-be-created-after-january-1-2026), [Shopify — Select a distribution method](https://shopify.dev/docs/apps/launch/distribution/select-distribution-method), [Shopify — Client credentials grant](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/client-credentials-grant), [Shopify — Get API access tokens](https://shopify.dev/docs/apps/build/dev-dashboard/get-api-access-tokens), [Shopify — Authorization code grant](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/authorization-code-grant), [Shopify — Manage credentials](https://shopify.dev/docs/apps/build/authentication-authorization/manage-credentials), [Shopify — Dev Dashboard user permissions](https://shopify.dev/docs/apps/build/dev-dashboard/user-permissions), [Shopify — Dev Dashboard store collaborations](https://shopify.dev/docs/apps/build/dev-dashboard/stores/collaborations), [Shopify Help Center — working on client stores](https://help.shopify.com/en/partners/manage-clients-stores/working-on-client-stores), [Shopify API Terms](https://www.shopify.com/legal/api-terms). Community threads are linked as evidence of what developers and Shopify staff wrote in them, on the dates given, not as statements of Shopify policy.