Shopify Apps 2026-07

Use these rules for apps targeting GraphQL Admin API and webhook version 2026-07. Apply extension rules to the selected extension API version and runtime. OAuth, App Bridge, SDK releases, and App Store requirements have independent lifecycles; the Admin API version does not freeze them. Apply the security guidance for the backend language and framework alongside these rules.

Request authentication and shop identity

• Authenticate protected merchant routes with Shopify's supported library, such as authenticate.admin(request); use the distinct verifier for webhooks, app proxies, and extension requests instead of treating their credentials as interchangeable.
• Verify embedded-app ID tokens, formerly session tokens, before exchanging them or accessing data: require HS256 with the app client secret, valid exp and nbf, the expected client ID in aud, and matching iss and dest hostnames for a valid Shopify shop.
• Derive the canonical shop from verified token or session context and the staff identity from its authenticated user; reject conflicting shop parameters before selecting stored credentials, queues, caches, or database rows.
• Obtain an ID token through App Bridge for each backend request; send it only to your app's trusted backend. Treat it as a bearer credential with a one-minute lifetime, not an Admin API access token or a single-use nonce; App Bridge can return a still-valid cached token.
• Authorize the requested action and resource separately from token validation; an ID token carries identity without staff permissions, and a valid Shopify global