Script tags, expiring tokens and the new theme architecture: what to check in your Shopify store before 2027

What Shopify has announced and the key dates

The developer section of Editions Fall '26 contains three messages that matter to anyone running a store: apps can no longer create or update script tags and must move to theme app extensions or web pixels; apps must migrate to expiring tokens before January 2027 to stay listed in the Shopify App Store; and each app can restrict which IP addresses are allowed to call the API.

The shopify.dev changelog spells out the timeline. Since October 1, 2026, apps cannot create or update script tags in any API version, although existing ones keep running. On March 1, 2027, Shopify will stop injecting script tags into storefronts. On the Order status page, script tags already stopped working on August 26, 2026.

For tokens, the October 2026 security update sets January 1, 2027 as the deadline for public apps that call the Admin API. Consequences then build up until April 1, 2027, when requests made with non-expiring tokens start to fail.

• August 26, 2026: script tags stop working on the Order status page
• October 1, 2026: apps can no longer create or update script tags
• January 1, 2027: public apps without expiring tokens are delisted and blocked from new installs
• January 15, 2027: merchants using a non-migrated app see a warning in the admin
• March 1, 2027: Shopify stops injecting script tags into storefronts
• April 1, 2027: the Admin API returns HTTP 403 to requests using non-expiring tokens

What a script tag is and what stops working in your store

A script tag is a piece of JavaScript that an app registers in your store through the API so Shopify loads it on every page. For years it was the usual way for an app to add a reviews widget, a chat, a pop-up or a tracking code without touching the theme. Shopify has offered theme app extensions as the replacement since 2021, but many older or poorly maintained apps still rely on script tags.

On March 1, 2027 those scripts will stop loading. Whatever depends on them will simply disappear from the storefront: a widget that no longer shows, a button that does nothing or, most sensitive of all, a conversion pixel that stops sending data without anyone noticing for weeks. That last case is the most expensive, because campaigns keep spending while measurement is broken.

Shopify names two replacements. For scripts that load JavaScript on the storefront, an app embed block inside a theme app extension, which the merchant activates in the theme editor. For analytics and conversion tracking, a web pixel, which according to Shopify needs no action from the app user. To customize the Order status page, customer account UI extensions.

Expiring tokens: what changes and who is affected

When you install an app, Shopify gives it an offline access token so it can work with your data while you are not logged in. Until now that token never expired, so if it leaked it stayed valid indefinitely. The new offline tokens expire after 60 minutes and rotate automatically, which greatly limits the damage of a leak.

The change affects public apps, the ones installed from the App Store or through a developer link, that call the Admin API with non-expiring tokens. Shopify is clear that custom apps, merchant-created apps and online access tokens are not affected. You do not need to reinstall anything either: the app exchanges its old token for a new one in its own code.

For you as a merchant, the real risk is having a public app installed whose developer does not migrate in time. From January 1, 2027 that app will be delisted from the App Store and blocked from new installs, on January 15 you will see a warning in the admin, and on April 1 its Admin API requests will start failing. Shopify stresses that those later dates are there to give merchants time to prepare and are not extra time to migrate.

Which integrations can break: tracking, ERP and custom apps

The first thing to review is tracking. If an advertising pixel, analytics tool or affiliate code reaches your store through an old app rather than through Customer events or an official integration, it may depend on script tags. The same goes for reviews widgets, chats, lead capture pop-ups or size pickers installed years ago.

Next come integrations with external systems: connectors to your ERP, warehouse, invoicing or marketing tools. If the connector is a public app from the App Store, it depends on its developer migrating to expiring tokens. If it is a custom app built for your store, the token requirement does not apply according to Shopify, but the end of script tags does affect it if it injects code into the storefront.

Finally, review any older custom development. It is common to find stores with a private app built by a freelancer years ago that nobody maintains and that adds a script to the storefront. Nobody will warn you about that piece, and it will quietly stop working in March 2027.

• Advertising and analytics pixels installed by old apps
• Reviews, chat, pop-up or recommendation widgets
• Connectors to ERP, warehouse, invoicing or CRM
• Private or custom apps with no maintenance
• Customizations on the Order status page

How to audit your apps step by step

You do not need to read code to get started. Make an inventory of every app installed under Settings, in the apps section, and note which are public, which are custom and which you no longer use. Uninstalling what you do not need is the simplest step and removes the most risk, because every abandoned app is one less piece to review.

Then open the theme editor and look at the app embeds section. Apps that already work through theme app extensions appear there as toggles. Under Settings, in Customer events, you will see the web pixels you have active. If an app adds something visible to your store and does not appear in either place, ask its developer how it does it.

With the list ready, write to each developer with two specific questions: whether their app uses script tags on the storefront and whether it already uses expiring offline tokens. For custom integrations, ask the agency or freelancer who built them. Keep the answers with a date, because they will help you decide what to replace before March.

• List every installed app and remove the ones you do not use
• Separate public apps, custom apps and in-house development
• Review the app embeds in the theme editor
• Review the active pixels in Customer events
• Ask each developer about script tags and expiring tokens
• Check on a duplicated theme that reviews, chat and pop-ups still work
• Verify conversions in your ad platforms after every change

Security: client credentials and per-app IP allowlists

The October 2026 security update brings other features aimed at developers that also protect you as a merchant. With client credentials access, if an app loses its refresh token, its backend can request a new token signed with the app's private key without waiting for you to open the app again.

The IP allowlist lets the developer list their servers' addresses, and Shopify rejects Admin API requests coming from any other address, even with a valid token. Editions describes it as a way to block unauthorized access through compromised tokens. Apps can also declare in their configuration the servers they communicate with, and Shopify uses that list to spot unexpected requests.

You do not have to switch any of this on yourself, but you can ask the developers of apps that handle sensitive data, such as orders or customers, whether they already use it. It is a good sign that the app is well maintained.

New theme architecture and faster store pages

On the theme side, Editions introduces a new architecture in which pages are written in Liquid with blocks, typed contracts and partial updates, with Markdown guides to steer AI agents and built-in Tailwind styles. Shopify also says online store pages load faster because it serves only the CSS each store needs.

For a live store none of this requires action before 2027. It is, however, one more reason to move any app-injected script into theme app extensions: code that lives in blocks and app embeds fits the way Shopify is evolving themes, while scripts added from the outside are increasingly isolated.

For headless projects, Shopify announces one-click Vercel deployments for Hydrogen and introduces Vercel Shop, a Next.js template built on the new Hydrogen SDK. It is only relevant if you already run a custom storefront outside the theme.

How Weblineo helps with this review

Weblineo has worked only with Shopify since 2016 and is a Shopify Plus Partner. We review the apps and integrations in your store, identify what depends on script tags or on apps that have not migrated, and hand you a prioritized list of what to keep, replace or remove.

When a feature depends on an old script or on an app that will not be updated, we rebuild it as our own code inside the theme or in a theme app extension, and move tracking to web pixels. Everything at a fixed price and tested on a duplicated theme before it goes live.