New trusted vault origin signal in Payments Apps API
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on October 30, 2026.
This Shopify update is categorized as API, New, Payments Apps API, 2027-01.
What changed
Shopify can include trusted_vault_origin in both encrypted card and payment_instrument payloads. Read it from payment_method.data, outside the encrypted card details or payment_instrument object. true: Don't reject the payment or verification for missing CVV alone. A CVV may still be present. false or absent: Keep your existing CVV rules for that flow, including flows that accept payments without CVV.
Who is affected
This applies to payments apps that handle requests with payment_method.type set to credit_card. Your extension must use API version 2027-01 or later, and Shopify must enable the field for your app. Changing the API version does not enable it.
What action may be needed
No immediate production migration is required. Use the 2027-01 release candidate for testing and keep production apps on a supported stable version. To prepare your integration: Review your payment and verification handlers. Add support for the optional field and the CVV handling described above.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →