Shop SDK lead capture now supports Rich Authorization Requests
Lead capture now accepts an authorizationDetails attribute. The attribute takes a serialized JSON array that lists the fields your app needs and marks each one as required or optional.
Start Sidekick conversations from your app
Embedded apps can now launch Sidekick with a pre-filled prompt using the Sidekick Launch API, so merchants can get contextual help without leaving your app. From within the Shopify admin, your app can start a Sidekick conversation on the merchant’s behalf.
Editions: Fall 2026
Shopify App Pricing: Plan Feature Targeting
The plan editor in the Partner Dashboard has a new Store requirements section for public plans.
Shopify App Store: Estimated local-currency prices
The Shopify App Store and the Shopify admin show app prices as estimates in the merchant's billing currency, for example €17.67 EUR/month. Estimates appear in these places: Your app listing and app cards on the Shopify App Store.
Merchant email now available on the `ThemeSale` object in the Partners API
You can now access the purchasing merchant's email on the ThemeSale object in the Partner API, which lets you connect with the merchants using your themes to provide support, share updates, and build lasting relationships.
Introducing theme app add-ons: Build and bundle apps with your themes
Theme developers can now build storefront apps using theme app extensions and bundle them with their theme listings on the Theme Store.
Make your app's activity reportable in Shopify Analytics with App Events
Apps can now declare events in an analytics_app_events extension. When an app sends a declared event through the App Events API, merchants can report on it in Shopify Analytics.
App Events: Send events from Checkout and Customer Account UI extensions
The new shopify.appEvents.emit() method sends a custom event with an event handle and optional attributes. Shopify adds your app and the shop to each event, so you don't need an access token or a shop ID.
Shopify Flow: manage automations through AI Toolkit
You can now use an external agent to manage your Shopify Flow workflows through AI Toolkit. This release is for managing your own store's workflows via AI toolkit; third-party apps are prevented from using the underlying APIs directly.
Managed mode for Shopify Tax
Shopify Tax managed mode helps Shopify apply the correct tax behavior for US sales by managing some store settings and API behavior directly. To keep those settings consistent, some Admin API writes now validate against the requirements of managed mode.
First sign-ins to customer accounts now set Customer.state and send customers/enable webhooks
When a customer signs in to customer accounts for the first time, Shopify sets Customer.state to ENABLED. Shopify then sends the customers/enable and customers/update webhooks.
Add selling plans to draft order line items with the Admin GraphQL API
Admin GraphQL API version 2027-01 adds selling plan support to draft orders. You can now apply a selling plan to a draft order line item and read back the applied plan.
Cart and checkout permalinks now support UCP at /buy
Shops now list the dev.ucp.shopping.permalink capability in their UCP discovery profile at /.well-known/ucp, and its config.endpoint points to the shop’s /buy route.
Store and app install details in the Dev Dashboard
You can now view your organization’s installed apps, collaborator access, earnings, and app activity in one place in the Dev Dashboard. Use the store page to view apps, users, and earnings for a store: Apps from your organization installed on the store.
Manage payouts, billing, and settings in Dev Dashboard
The Settings and Payouts links in Partner Dashboard and the Home payout widget have moved to Dev Dashboard. To reach the new pages, open Dev Dashboard, select your organization, and open Organization settings.
Security update: Offline token dates, new security features
On October 20, we asked all app devs to secure their app, and told you we'd share more before any security change takes effect. Here's what's new, and what you need to do.
Migrate to expiring offline access tokens before January 1, 2027
Public apps still using non-expiring offline access tokens must migrate to use expiring offline access tokens before January 1, 2027 to remain listed in the Shopify App Store and continue accepting new installs.
Secure your app with network access rules in `shopify.app.toml`
The new network_access section has two properties: allowed_navigation_hosts: The external sites your app links to from the storefront, such as your own domain. Shopify normally warns customers before sending them to a site outside the storefront.
Restrict Admin API access with an IP allowlist
Your app's Settings page has a new IP allowlist section. Enter your servers' addresses or CIDR ranges, test them against recent traffic, and enable enforcement.
Promoted Placements beta now includes Shop Campaigns
Merchants running Shop Campaigns with external platforms turned on now include the Catalog API as one of those platforms.
Search brands that don't sell on Shopify in the Catalog API (beta)
The Catalog API beta now supports a sources parameter on search_catalog that controls which products you return: Shopify merchant products only: omit sources, or set ["shopify"] Both Shopify merchant and external products: ["shopify", "external"] Brands that…
Analytics queryable capability is configurable in shopify.app.toml for metaobject definitions
Metaobject definitions declared under [metaobjects.app.<name>] in shopify.app.toml now accept capabilities.analytics_queryable.
Unlink a customer's identity provider subject with the GraphQL Admin API
As of API version 2027-01, you can use the identityProviderSubjectDelete mutation to unlink a customer from a third-party identity provider. Pass the customer's ID as customerId and the identity provider subject's ID as id.
Discover a merchant's retail stores with UCP location search and lookup
Storefronts with at least one retail location now list both location capabilities in their discovery profiles at /.well-known/ucp.
POS UI extensions now support reactive storage access
shopify.storage.current exposes each storage key as a read-only reactive signal. You can read its current value or subscribe to changes made by other targets of the same extension on the same POS device.
POS UI extensions 2026-10 adds s-pos-list, a virtualized list with custom row templates
The List component ended with API version 2025-07, and Polaris web components had no list component to replace it. s-pos-list fills that gap.
Polaris 2.0 is now stable
Polaris 2.0 is now stable Polaris Web Components 2.0 is now available on the stable Polaris CDN channels. It's the first major release under the CDN's semantic versioning model.
Metaobject analytics queryable capability available in the Admin API
The GraphQL Admin API now exposes the analytics queryable capability for metaobject definitions. You can read MetaobjectCapabilities.analyticsQueryable, which includes: eligible: whether the metaobject definition can use the capability.
Securing your app, together
Merchants install your app because they trust it, and because they trust the Shopify App Store. There are bad actors out there who are motivated to exploit that trust.