The Shopify token your software asks for can't be created any more. The one already made still works.

You follow the guide. It says open your Shopify admin, make a custom app, copy the access token, paste it into the tool. The person who wrote the guide has that token. You cannot make one — and it is not because you did it wrong.

It always fails at the same step. You have the store, you have the software, and the connection screen has a box in it waiting for an access token. The guide says go to your admin and generate one. The guide is not lying. It is older than the rule.

Here is the part no guide mentions: since 1 January 2026 you can no longer create a custom app inside the Shopify admin. Apps created before that date were left alone. The token exists for whoever made it, and cannot be made by whoever did not.

What changed, and when

Shopify announced it on its changelog on 30 October 2025, under the title «Legacy custom apps can't be created after January 1, 2026». One sentence does the work: «Starting January 1, 2026, you can no longer create new custom apps in the Shopify admin.»

That date has passed, and the developer documentation now says it in the present tense: «You can no longer create new admin-created custom apps.» It also confirms the other half — «Existing custom apps aren't affected and will continue to work.»

Which apps, exactly? Shopify is precise: «Admin-created custom apps are apps created directly in the Shopify admin, without going through the OAuth installation flow.» No install screen, no permission prompt, just a token sitting there to be copied. That is the flow every paste-the-token tutorial describes.

It has nothing to do with how new your store is

This is where most explanations go wrong. It is not a new-store problem. The help centre puts the line where it actually falls: «If you have legacy custom apps created before January 1, 2026, you can manage them from your Shopify admin.» The date belongs to the app, not the store. Ten years of trading and you never happened to make one? You cannot make one now.

The sentence Shopify wrote about your tool

You do not have to guess whether your connection screen is out of date. Shopify put it in the documentation: «Some external tools ask you to copy a token or provide a 'Shopify API key.' These tools expect the older authentication flow.»

That is a diagnostic sentence, not an accusation. A box asking for a token was built around a flow the admin no longer produces. Whether that particular tool has since added another way in, only that tool can tell you.

If you still have one: do not delete it

This is the most useful line in the documentation, and the easiest to walk straight past: «Don't delete the app itself. Deleting removes the app configuration from the Shopify admin permanently, and you can't create a new admin-created custom app to replace it.» One tidy-up of an apps list you did not recognise and it is gone. Not disabled. Gone.

Two more things about an app you already have. You cannot rotate the API key or secret on one of these — Shopify says so plainly. And to regenerate the token you uninstall and reinstall the app from the admin, which existing apps can still do.

Tokens did not disappear. That one did.

Be precise here, because the wrong summary is doing the rounds. Shopify still issues access tokens. What ended is the one you could read off a page in your own admin and paste somewhere.

The middle row is where the substitution quietly breaks. With a client credentials grant «you won't see a token in the Shopify admin. Instead, you request tokens programmatically when you need them» — nothing to copy, and what arrives lasts a day.

Why the substitute will not connect a third-party tool

The limit is stated outright: «The client credentials grant only works when the app and the store belong to the same Shopify organization», and «Client credentials can't reach a store outside your organization, including a client's store.»

So it is a fine answer for your own store and your own script. It is not how a piece of software you bought connects to your shop. For that, Shopify's documented route is OAuth: apps with public distribution use token exchange or the authorization code grant and «can be installed on multiple Shopify stores», while custom distribution covers a single store, or several in the same Plus organization.

What we do, and where we are no help

Ours, not a rule: DropMind connects Shopify through the OAuth route, so there is no token to copy anywhere. You authorise it from inside Shopify, and nothing lands in your clipboard. The paste-a-token field still exists behind an «advanced» button, for people whose app predates the change and would rather keep using it.

Where we are genuinely no use: if you have your own store, someone who writes code, and a script that only ever talks to that one store, none of this needs buying. The Dev Dashboard and a client credentials grant are built for exactly that. And if you have already deleted a custom app, we cannot bring it back. Nobody can — that is what «permanently» meant.

Where this comes from

Every quoted line above is Shopify's own, read on 1 September 2026 on the pages below: the changelog, the developer documentation and the merchant help centre, and nothing else. Forum threads and agency posts describe this change in wording that does not match the official pages, so we left them out.

Shopify's stated reason is security and long-term support; anything beyond that would be us guessing at intentions. And this documentation gets rewritten often — if a sentence here decides something for you, open the source and check it is still there.