Shopify stopped letting you create custom apps. Here is what replaced it

Since 1 January 2026 you can no longer create a legacy custom app in your Shopify admin. If you followed a tutorial that says Settings → Apps and sales channels → Develop apps and the button is not doing what the screenshots show, that is why. The replacement exists, it is not much harder, and it is better.

What actually changed

The old flow created an app that lived in your store and handed you a permanent access token — a long string starting shpat_ — which you pasted into whatever tool needed it. That token never expired. Convenient, and exactly the problem: a string that never expires, copied into tools and config files, is a key you cannot take back without noticing you need to.

Existing legacy custom apps keep working. You just cannot make new ones.

What to do instead

You create the app in the Shopify Dev Dashboard instead of in your store's admin, and it still belongs to your store. What you copy out is different: instead of one permanent token, you get a Client ID and a Client secret. The tool exchanges those for an access token that lasts 24 hours and refreshes itself.

1. Open dev.shopify.com/dashboard and press Create app.
2. Give it a name — whatever tool you are connecting.
3. In the Versions tab, turn on only the scopes that tool needs. For product editing that is usually read_products and write_products. Press Release.
4. Press Install app on your store.
5. In Settings, copy the Client ID and Client secret into the tool.

About a minute, once, per tool.

Why this is better, even though it is one more step

A 24-hour token that refreshes is worth more than a permanent one that does not. If a token leaks — a screenshot, a support ticket, an old config file in a repo — the window is a day rather than forever. Shopify is moving the whole platform this way: expiring tokens became mandatory for new public apps from 1 April 2026.

You also get a real place to see what you have connected. Legacy custom app tokens were scattered across whatever tools you pasted them into. Apps in the Dev Dashboard are listed, and you can revoke one without touching the others.

The part that catches people out

This flow only works when the app and the store are in the same Shopify organization. In other words, the app has to be created by you, inside your own store — you cannot create one and point it at somebody else's shop. If a tool asks you to create the app yourself rather than handing you an "Install" button, that is not laziness on their part; it is the only way this grant type works without them running a server.

It has a side effect worth knowing: a tool built this way has no server holding your credentials, because there is no server for them to sit on. Your keys go from your store to the tool running in your own account, and nowhere else.

If you still have an old token

It keeps working. There is no forced migration date announced for legacy custom apps that already exist. But it is a permanent credential in a platform that is deliberately moving away from those, so when a tool offers both, the Client ID route is the one to pick.

Storesheet accepts either: paste the Client ID and secret, or paste an old shpat_ token into the Client ID box and leave the secret empty.

Shopify's changelog entry is "Legacy custom apps can't be created after January 1, 2026". Dates and scope names change; check Shopify's current documentation before relying on any of this.