Do existing legacy custom apps stop working in 2026?

No. Shopify's change only blocks creating new legacy custom apps after January 1, 2026. Existing admin-created apps and their tokens keep working. The deadline bites when you onboard a new store or need a new app.

How do I create a Shopify custom app after January 2026?

Through the Dev Dashboard (or Shopify CLI): create the app, configure scopes, choose custom distribution, and install it on the store via an install link. The authentication grant depends on the app and store relationship: client credentials is for stores in your own organization; a custom app on a client store uses token exchange if embedded or the authorization code grant if standalone.

Why did Shopify retire admin-created custom apps?

Shopify describes the change as improving security and long-term support. Existing legacy apps keep working; new apps are created in the Dev Dashboard. The change does not mandate one authentication grant for every app.

I'm a vendor with one backend serving many client stores on legacy custom apps. What should I do?

Nothing breaks today, but every new client needs the new flow. The scalable pattern is a dedicated custom-distribution app per client store in your own Partner organization — plan the migration before growth forces it.

Shopify is deprecating legacy custom apps (Jan 2026): what vendors need to do

Short answer: since January 1, 2026, merchants can no longer create new "custom apps" from the Shopify admin (Settings → Apps → Develop apps). Existing legacy custom apps keep working — nothing is being switched off. New custom apps are created through the Dev Dashboard. The authentication grant depends on who owns the app and store: client credentials is restricted to stores in your own organization; a custom app installed on a client’s store uses token exchange if embedded or the authorization code grant if standalone. If you're a vendor whose integration model was "each client creates a custom app in their admin and sends us the token," that model is closed to new clients, and you need a replacement pattern.

Here's what changed, what didn't, who's actually affected, and the realistic migration paths.

What exactly changed on January 1, 2026?

One thing: creation. The admin flow that let any merchant mint a custom app with permanent Admin API access tokens no longer allows creating new apps. Per Shopify's changelog:

Existing legacy custom apps are not affected — they continue running, tokens included.
New custom apps are created in the Dev Dashboard (or via the Shopify CLI) and installed on a store through a custom-distribution install link.
Creation in the Dev Dashboard does not select the authentication grant. App/store ownership and whether the app is embedded determine the supported flow; a client-credentials request cannot authenticate a custom app against another organization’s store.

Why did Shopify do this?

The stated direction is security and manageability, and it's credible: legacy custom apps issued non-expiring tokens with no rotation story, which lived in configs, emails, and forgotten spreadsheets. If one leaked, it was valid until someone remembered to uninstall the app. The Dev Dashboard model brings custom apps in line with how every other Shopify app authenticates, gives merchants a clearer picture of what's installed with which scopes, and gives Shopify one app-creation pipeline instead of two.

Who is affected — and who isn't

Not affected (today):

Merchants running existing admin-created custom apps.
Public apps, listed or unlisted — different pipeline entirely.
Existing custom-distribution apps created from a Partner organization.

Affected:

Merchants who need a new private integration — the admin path is gone; someone must create the app in a Dev Dashboard organization.
Vendors and agencies whose onboarding step was "have the client create a custom app and send us credentials." This is the big one. That pattern was the quiet backbone of one-backend-many-stores setups precisely because it needed no review and no Partner-org gymnastics. Every new client now requires the new flow.
Collaborator-based workflows. The Dev Dashboard assumes the app and store belong to the same organization, and collaborator accounts don't get org-level Dev Dashboard access — a live pain point raised repeatedly on Shopify's dev forums. "I'll just create it from inside the client's account as a collaborator" is not the clean path it used to be.

What are the migration options for a multi-store vendor?

You have three realistic patterns. (For the full decision tree including public/unlisted apps, see How to install a Shopify app on multiple stores.)

1. Have each merchant create the app in their own Dev Dashboard organization

The merchant (or you, given org access) creates the app under their organization and installs it. Client-credentials auth is available only when that app and the store belong to the same organization; the backend still needs secure credential handling and token renewal. It works, but it moves setup complexity onto the client — the person least equipped for it — and multiplies the "please click through this dashboard" onboarding calls. It also scatters your fleet's apps across N organizations you don't control.

2. An unlisted public app

One app, installable on any merchant's store by link, no App Store listing. The trade: it's still a public app — Shopify app review, public-app requirements, and review cycles on your release cadence, forever. Right answer for some products; heavy for private client tooling.

3. A dedicated custom-distribution app per client store, in your Partner organization

Create one custom-distribution app per client store, using your single codebase. Each app has its own credentials and scopes. The merchant approves installation in Shopify; your backend must support the appropriate token-exchange or authorization-code flow. A single custom app cannot serve unrelated merchants. Custom distribution does not provide a public App Store listing or Shopify Billing.

The cost is operational: N apps means N creations, N configs to keep in sync, N deploys per release, N credential sets, N installs to monitor.

Where DeploTeka fits: DeploTeka manages dedicated custom-distribution apps in your Shopify organization, delivers credentials to your backend, and tracks per-store setup, releases and available installation evidence. You run your app code locally or in CI, and each merchant approves installation. See the supported integration paths before starting; missing evidence stays unknown. Founder-owned development-store checks do not establish an independent agency’s completed journey.

A practical checklist for vendors

Inventory every store you serve and how its app was created (legacy admin app vs custom distribution vs other). You can't plan a migration you haven't mapped.
Freeze new legacy-style onboarding in your runbooks — it silently fails now, usually mid-sales-cycle.
Pick your target pattern (above) and onboard the next new client with it before touching existing stores.
Migrate opportunistically, not big-bang. Existing legacy apps work; move stores when you're already touching them (scope changes, re-negotiations, incidents).
Plan credential renewal and rotation. Follow the rules for the actual grant and app type. A grant name is not proof that secret rotation, token renewal or revocation has been implemented.

Sources: Shopify changelog — Legacy custom apps can't be created after January 1, 2026, Shopify — Create apps using the Dev Dashboard, Shopify — About app distribution, Shopify — Client credentials grant, Shopify dev forums — collaborator permissions and the Dev Dashboard.