Shopify breaking changes, updated weekly

Every verified Shopify trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all Shopify traps.

1. fg-0325· added 2026-10-15· last checked 2026-10-15

   App Store review rejects the app over the mandatory compliance webhooks it never subscribed to

   Symptom

   App submission rejected for missing customers/data_request, customers/redact or shop/redact handling

   Fix

   Declare the compliance topics in shopify.app.toml, verify HMAC and return 401 on mismatch, and deploy before submitting.

2. fg-0326· added 2026-10-15· last checked 2026-10-15

   bulkOperationRunQuery fails because another bulk operation is already running for the shop

   Symptom

   A bulk query operation for this app and shop is already in progress

   Fix

   Move to API 2026-01 or later for concurrent queries, otherwise serialize bulk jobs per shop, and download results promptly.

3. fg-0328· added 2026-10-15· last checked 2026-10-15

   Customer email, phone or address comes back null with 'This app is not approved to access the Customer object'

   Symptom

   This app is not approved to access the Customer object.

   Fix

   Choose a distribution method first, then request protected customer data access in the Partner Dashboard and select each field you use. Development store installs need the selection but not the review.

4. fg-0332· added 2026-10-15· last checked 2026-10-15

   Shopify GraphQL throttling and access errors arrive with HTTP 200, so res.ok checks treat them as success

   Symptom

   HTTP 200 with errors[0].extensions.code THROTTLED and data null

   Fix

   Inspect the errors array on every response, retry THROTTLED after waiting for the bucket to refill, and pace requests from extensions.cost.throttleStatus.

5. fg-0333· added 2026-10-15· last checked 2026-10-15· deadline 2027-01-01

   Shopify offline access token stops working after an hour, or on January 1 2027 if it never expires

   Symptom

   [API] Invalid API key or access token about an hour after install

   Fix

   Request expiring=1 in token exchange, store the rotating refresh token, and refresh from one place per shop before expires_in runs out. Apps on the official templates refresh automatically.

6. fg-0336· added 2026-10-15· last checked 2026-10-15

   Shopify webhooks silently stop arriving after the endpoint was slow or down for a few hours

   Symptom

   webhookSubscriptions no longer lists a topic your app created at install

   Fix

   Acknowledge with 200 right away and process from a queue, dedupe on X-Shopify-Webhook-Id, and run a reconciliation job. Prefer shopify.app.toml subscriptions, which Shopify does not delete on failure.

7. fg-0337· added 2026-10-15· last checked 2026-10-15

   webhookSubscriptions query returns nothing although webhooks from shopify.app.toml are being delivered

   Symptom

   webhookSubscriptions returns an empty list for topics that clearly fire

   Fix

   Check toml subscriptions in the Dev Dashboard under the app version, delete the old API-created subscriptions to the same topics before migrating, and run shopify app deploy after each toml change.

8. fg-0331· added 2026-10-15· last checked 2026-10-15

   productCreate makes only one default variant, so multi-variant products need a second mutation

   Symptom

   Created product shows a single Default Title variant

   Fix

   Create the product with its options, then add variants with productVariantsBulkCreate, or send the full state with productSet for imports.

9. fg-0334· added 2026-10-15· last checked 2026-10-15· deadline 2027-01-16

   Shopify responses change shape without a deploy because the pinned API version was retired and Shopify fell forward

   Symptom

   X-Shopify-API-Version response header shows a newer version than the one in the request URL

   Fix

   Read the X-Shopify-API-Version header on responses and webhooks, alert when it differs from what you pinned, and move the pin plus the shopify.app.toml webhooks api_version forward every quarter.

10. fg-0335· added 2026-10-15· last checked 2026-10-15

    Shopify webhook HMAC check always fails because the framework parsed the JSON body first

    Symptom

    Computed digest never matches X-Shopify-Hmac-SHA256

    Fix

    Read the raw body for the webhook route only, compute HMAC SHA256 with the app client secret, and compare with a timing-safe check. After rotating the secret, expect the old one in signatures for up to an hour.

11. fg-0327· added 2026-10-15· last checked 2026-10-15

    Custom session token verification fails with 'jwt not active' or 'jwt expired' in an embedded Shopify app

    Symptom

    InvalidJwtError: Failed to parse session token

    Fix

    Fetch a fresh token with shopify.idToken() for every request, keep server time synced, and pass a small clock tolerance when verifying yourself.

12. fg-0329· added 2026-10-15· last checked 2026-10-15

    GraphQL Admin query fails with MAX_COST_EXCEEDED even though it returns only a few records

    Symptom

    Query cost is 2003, which exceeds the single query max cost limit (1000).

    Fix

    Lower first on the outer and inner connections, page the inner connection separately, or switch to a bulk operation for full exports.

13. fg-0330· added 2026-10-15· last checked 2026-10-15

    New public Shopify app built on the REST Admin API is blocked from the App Store

    Symptom

    A new public app built on REST Admin calls cannot pass App Store submission

    Fix

    Build new public apps on the GraphQL Admin API from the start and treat REST code samples as legacy.