Shopify Private Apps Are Gone: Custom App vs Public App vs Dev Dashboard (2026)

If you're searching for how to build a Shopify "private app", the answer in 2026 is that you can't. You also can't create a custom app from the Shopify admin any more. Since January 1, 2026, new custom apps are built in the Dev Dashboard and then installed on a store. Existing apps keep working.

This guide explains what changed, the options you have today, which one fits your project, and how each type gets API access.

How we got here

• January 2022: Shopify deprecated private apps in favour of custom apps created in the Shopify admin.
• January 20, 2023: all remaining private apps were automatically converted to custom apps.
• October 30, 2025: Shopify announced that custom apps could no longer be created in the admin from January 1, 2026.
• January 1, 2026: new custom apps are built in the Dev Dashboard. Custom apps created in the admin before that date, now called legacy custom apps, keep working and can still be managed from the admin.

Your four options today

1. Keep an existing legacy custom app

If an admin-created custom app still does its job, for example an ERP sync or a reporting script calling the Admin API, you don't have to replace it. If it still uses the REST Admin API, plan its move to the GraphQL Admin API anyway, because REST is legacy. Know its limits, though: legacy admin apps can't use App Bridge to display inside the Shopify admin and can't use app extensions. As soon as you need an admin UI, a theme app block, a checkout extension or a Function, you need a Dev Dashboard app.

2. Build a Dev Dashboard app with custom distribution

This is the replacement for "private" and admin-created apps. A custom-distribution app can be installed on:

• a single Shopify store
• several stores that belong to the same Shopify Plus organization
• transfer-disabled development stores

Custom apps don't go through App Store review, and they can use modern features: App Bridge, app extensions, and Functions (with the plan limits below). They can't charge merchants through Shopify's billing system, so bill the client directly.

3. Build a public app

A public app is listed on the Shopify App Store and can be installed by any merchant. It goes through App Store review, can use Shopify's app billing, and must meet public-app rules. One example is expiring offline access tokens for the Admin API, required for all public apps from January 1, 2027 (our migration guide).

4. Use an existing App Store app

It's often the cheapest option. If an established app covers 90% of the need, a custom build rarely pays off. Check the App Store before commissioning anything.

Which one fits?

• One store needs an integration or custom logic → custom distribution.
• Several stores in one Shopify Plus organization, such as regional expansion stores → custom distribution.
• You want to sell the app to many merchants → public distribution.
• An existing legacy custom app only calls the Admin API and works → keep it for now, and rebuild when you need extensions or Functions.
• A mature App Store app already does it → install that app.

Choose carefully: Shopify states that you can't change the distribution method after you select it. An app built for one client under public distribution is stuck with App Store review and public-app requirements.

Plan limits worth knowing

• Functions in custom apps need Shopify Plus. Stores on any plan can use public apps that contain Functions, but only Plus stores can use custom apps that contain Function APIs. On a non-Plus store, custom discount, delivery or payment logic has to come from a public app. Our guide to Shopify checkout customization by plan covers the same limit from the checkout side.
• Checkout UI extensions on the Information, Shipping and Payment steps are Plus-only. Extensions on the Thank you and Order status pages work on every plan.

How each type gets API access

Stores in your own organization: client credentials

For a server-side app acting on stores in your own Shopify organization, the Dev Dashboard app requests a token with the client credentials grant. There's no token to copy from the admin; you request one when you need it:

const response = await fetch(`https://${SHOP}.myshopify.com/admin/oauth/access_token`, {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: CLIENT_ID,
    client_secret: CLIENT_SECRET,
  }),
});
const { access_token, expires_in } = await response.json(); // expires_in: 86399 (24 hours)

These tokens expire after 24 hours, so cache the token and request a new one before it expires. Send it in the X-Shopify-Access-Token header.

A client's store: custom distribution plus OAuth

The client credentials grant only works when the app and the store belong to the same Shopify organization, so it can't reach a client's store. For client work:

1. Build the app in your Dev Dashboard and choose custom distribution for the client's store.
2. The merchant installs it from the install link.
3. Get tokens with token exchange if the app runs inside the Shopify admin (embedded), or the authorization code grant if it runs outside the admin.

Shopify CLI and the official app templates handle this OAuth for you.

Who can create apps

Store owners can create and manage custom apps. Staff need the App development > Develop permission. Collaborator accounts don't get access to the Dev Dashboard, which is one reason agencies usually build in their own organization and use custom distribution.

Replacing a legacy custom app

You only need to migrate when the legacy app is blocking something, such as an admin UI, an extension, a Function, or tidier credential management. The usual path:

1. List what the old app does: API scopes, webhooks, and every system that uses its token.
2. Build a Dev Dashboard app with custom distribution and the same, or narrower, scopes.
3. Install it, switch each integration to the new token flow, and confirm webhooks are registered.
4. Run both in parallel briefly, then uninstall the legacy app so its token stops working.

Common mistakes

• Choosing public distribution for one client. It's permanent and brings App Store review and public-app rules you don't need.
• Using client credentials on a client's store. It only works inside your own organization; use custom distribution and OAuth.
• Planning a custom Function for a non-Plus store. Custom apps with Functions need Plus.
• Hard-coding a 24-hour token. Client-credential tokens expire, so cache and refresh them.

Need an app built?

We build custom Shopify apps and integrations with Dev Dashboard apps and custom distribution: admin UIs with App Bridge, theme app extensions, checkout extensions, and Admin API integrations. See our Shopify app development services, or tell us what you need and we'll recommend the right app type before quoting.

Sources

• Shopify changelog: Legacy custom apps can't be created after January 1, 2026
• Shopify: About app distribution
• Shopify Help Center: About custom apps
• Shopify: Client credentials grant for Dev Dashboard apps
• Shopify changelog: Private apps are being automatically converted to custom apps
• Shopify: Shopify Functions