Do existing legacy custom apps stop working in 2026?

No. Shopify's change only blocks creating new legacy custom apps after January 1, 2026. Existing admin-created apps and their tokens keep working. The deadline bites when you onboard a new store or need a new app.

How do I create a Shopify custom app after January 2026?

Through the Dev Dashboard (or Shopify CLI): create the app, configure scopes, choose custom distribution, and install it on the store via an install link. Authentication uses OAuth client-credentials instead of a permanent admin token.

Why did Shopify retire admin-created custom apps?

Primarily security. Legacy custom apps used non-expiring Admin API tokens that were routinely pasted into emails and configs. The Dev Dashboard flow replaces them with OAuth client-credentials and gives merchants clearer visibility into installed apps.

Shopify is deprecating legacy custom apps (Jan 2026): what vendors need to do

Q: I'm a vendor with one backend serving many client stores on legacy custom apps. What should I do?

Nothing breaks today, but every new client needs the new flow. The scalable pattern is a dedicated custom-distribution app per client store in your own Partner organization — plan the migration before growth forces it.

Short answer: since January 1, 2026, merchants can no longer create new "custom apps" from the Shopify admin (Settings → Apps → Develop apps). Existing legacy custom apps keep working — nothing is being switched off. But every new custom app must now be created through the Dev Dashboard and authenticate with OAuth client-credentials instead of permanent admin tokens. If you're a vendor whose integration model was "each client creates a custom app in their admin and sends us the token," that model is closed to new clients, and you need a replacement pattern.

Here's what changed, what didn't, who's actually affected, and the realistic migration paths.

What exactly changed on January 1, 2026?

One thing: creation. The admin flow that let any merchant mint a custom app with permanent Admin API access tokens no longer allows creating new apps. Per Shopify's changelog:

Existing legacy custom apps are not affected — they continue running, tokens included.
New custom apps are created in the Dev Dashboard (or via the Shopify CLI) and installed on a store through a custom-distribution install link.
Authentication for the new-style apps uses the OAuth client-credentials grant — short-lived tokens issued from a client ID and secret — rather than a non-expiring token generated in the admin.

Why did Shopify do this?

The stated direction is security and manageability, and it's credible: legacy custom apps issued non-expiring tokens with no rotation story, which lived in configs, emails, and forgotten spreadsheets. If one leaked, it was valid until someone remembered to uninstall the app. The Dev Dashboard model brings custom apps in line with how every other Shopify app authenticates, gives merchants a clearer picture of what's installed with which scopes, and gives Shopify one app-creation pipeline instead of two.

Who is affected — and who isn't

Not affected (today):

Merchants running existing admin-created custom apps.
Public apps, listed or unlisted — different pipeline entirely.
Existing custom-distribution apps created from a Partner organization.

Affected:

Merchants who need a new private integration — the admin path is gone; someone must create the app in a Dev Dashboard organization.
Vendors and agencies whose onboarding step was "have the client create a custom app and send us credentials." This is the big one. That pattern was the quiet backbone of one-backend-many-stores setups precisely because it needed no review and no Partner-org gymnastics. Every new client now requires the new flow.
Collaborator-based workflows. The Dev Dashboard assumes the app and store belong to the same organization, and collaborator accounts don't get org-level Dev Dashboard access — a live pain point raised repeatedly on Shopify's dev forums. "I'll just create it from inside the client's account as a collaborator" is not the clean path it used to be.

What are the migration options for a multi-store vendor?

You have three realistic patterns. (For the full decision tree including public/unlisted apps, see How to install a Shopify app on multiple stores.)

1. Have each merchant create the app in their own Dev Dashboard organization

The like-for-like replacement: the merchant (or you, given org access) creates the app under their organization, installs it, and your backend uses client-credentials auth. It works, but it moves setup complexity onto the client — the person least equipped for it — and multiplies the "please click through this dashboard" onboarding calls. It also scatters your fleet's apps across N organizations you don't control.

2. An unlisted public app

One app, installable on any merchant's store by link, no App Store listing. The trade: it's still a public app — Shopify app review, public-app requirements, and review cycles on your release cadence, forever. Right answer for some products; heavy for private client tooling.

3. A dedicated custom-distribution app per client store, in your Partner organization

Create one custom-distribution app per client store, all running your single codebase. No review, no client-side setup beyond clicking an install link, per-client credentials and scopes under your control, and it works for non-Plus merchants. This is the pattern that most cleanly replaces the legacy model and improves on it — the credentials live in your org, not in a merchant's admin.

The cost is operational: N apps means N creations, N configs to keep in sync, N deploys per release, N credential sets, N installs to monitor.

Where DeploTeka fits: DeploTeka automates pattern 3 — it creates a dedicated custom-distribution app per client store from one codebase, inside your own Partner organization, and handles fleet-wide deploys, health, and credential management. We built it because we run our own pixel product across roughly 94 client stores and hit every one of these walls first.

A practical checklist for vendors

Inventory every store you serve and how its app was created (legacy admin app vs custom distribution vs other). You can't plan a migration you haven't mapped.
Freeze new legacy-style onboarding in your runbooks — it silently fails now, usually mid-sales-cycle.
Pick your target pattern (above) and onboard the next new client with it before touching existing stores.
Migrate opportunistically, not big-bang. Existing legacy apps work; move stores when you're already touching them (scope changes, re-negotiations, incidents).
Rotate secrets properly this time. Client-credentials auth gives you rotation — build it into ops rather than recreating the eternal-token problem with extra steps.

Sources: [Shopify changelog — Legacy custom apps can't be created after January 1, 2026](https://changelog.shopify.com/posts/legacy-custom-apps-can-t-be-created-after-january-1-2026), [Shopify — Create apps using the Dev Dashboard](https://shopify.dev/docs/apps/build/dev-dashboard/create-apps-using-dev-dashboard), [Shopify — About app distribution](https://shopify.dev/docs/apps/launch/distribution), [Shopify dev forums — collaborator permissions and the Dev Dashboard](https://community.shopify.dev/t/collaborator-develop-apps-permission-is-useless-with-new-dev-dashboard-jan-2026-cant-install-custom-app-on-clients-store/29171).