Shopify Apps 2026-04

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

1prompt
  1. Shopify Apps 2026-04115 lines · 5.8K tokens

CWE Coverage

  • 20
  • 79
  • 201
  • 208
  • 250
  • 287
  • 306
  • 319
  • 330
  • 347
  • 352
  • 359
  • 362
  • 367
  • 434
  • 532
  • 601
  • 602
  • 613
  • 639
  • 732
  • 770
  • 778
  • 807
  • 862
  • 863
  • 918
  • 922
  • 940
  • 943
  • 1021
  • 1395

Prompt Preview

Apply these rules to Shopify apps targeting the 2026-04 Admin, Storefront, Customer Account, Function, webhook, and UI extension APIs. App Bridge, OAuth endpoints, SDK releases, and platform security and privacy requirements evolve independently of that API version. Select a supported runtime for the SDK and hosting stack used by the app.

Version scope and supported tooling

  • Pin Admin requests to /admin/api/2026-04/graphql.json, Storefront requests to /api/2026-04/graphql.json, and Customer Account requests to the 2026-04 endpoint. Set [webhooks].api_version = "2026-04" in app configuration and api_version = "2026-04" in each Function or UI extension configuration, including POS.
  • Check X-Shopify-API-Version on API responses and webhook deliveries. Investigate unexpected fallback and migrate before 2027-04-16 15:00 UTC, when this line becomes inaccessible; expired versions fall forward to the oldest accessible stable version.
  • Build new Admin functionality on GraphQL. Keep retained REST calls explicitly versioned and remove their obsolete scopes during migration; new public apps must use GraphQL, and REST's legacy status does not justify bypassing authentication.
  • Patch the SDK independently of the API quarter, on releases that Shopify's advisories list as fixed. Read the JavaScript app-proxy advisory's fixed list yourself rather than waiting for npm audit or Dependabot, which may not report it. Check the @shopify/shopify-api copy that npm ls @shopify/shopify-api resolves under the React Router, Remix, or Express package, not only the wrapper's