Card deposit endpoint now requires mTLS certificate
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on July 16, 2026.
This Shopify update is categorized as API, Update.
What changed
The card-deposit endpoint at https://checkout-mtls.pci.shopifyinc.com/sessions is unchanged. What's new is that every request to it must present a Shopify-issued mTLS client certificate. Previously, requests to this endpoint did not require a client certificate. The GraphQL Admin API vault mutations are unchanged. You continue to call customerPaymentMethodCreditCardCreate and customerPaymentMethodCreditCardUpdate with the session identifier returned by the deposit call, and your GraphQL Admin API OAuth flow is unaffected.
Who is affected
This applies to apps that deposit cardholder data to Shopify through customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate. Apps that only call customerPaymentMethodRemoteCreate to import payment methods from external gateways such as Stripe, Braintree, Authorize.Net, Adyen, or PayPal are not affected and need to take no action.
What action may be needed
If your app deposits cardholder data, migrate before October 15, 2026: Confirm whether your app calls customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate. If it only calls customerPaymentMethodRemoteCreate, no action is required. Request a Shopify-issued client certificate at shopify-mtls-partnerships@shopify.com. Include your API client ID and technical point of contact.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →