Shopify Editions Fall 2026: What Engineers Need to Know

Shopify published its Fall '26 Edition, named Exponential, on 28 October 2026. The Editions site groups its updates into eleven sections, from agentic shopping to POS hardware. This post pulls out the changes that affect how stores are built, integrated and secured, and links each one to Shopify's own announcement, help page or developer documentation. Where Shopify marks something as early access, beta or coming soon, we say so. If you are catching up, our Spring 2026 Editions post covers the previous release.

The theme: Shopify in every agent and app

Shopify's developer announcement describes the release as opening the catalogue, cart and checkout to any agent or app. The pieces that make that concrete:

• shop.md and shop.dev. shop.md is a skill file that lets ChatGPT, Claude and other agents discover products, get recommendations and check out with Shop Pay. The tools used to build it are published at shop.dev.
• Shop Pay inside personal agents. Shoppers can check out with Shop Pay in Meta's Muse, Claude Duet, Grok Bot and Instinct, and buy from brands off Shopify through Claude Duet, Grok Bot and Instinct, with Mastercard and Visa supported and Amex described as coming soon.
• Checkout in Google. Stores can sell in Google Search, AI Mode and the Gemini app with checkout powered by Shopify. The order lands in the admin like any other.
• Shopify Catalog. A new eligibility page shows whether a store qualifies for Shopify Catalog and what to change if it does not. Catalog now passes the compare-at price to agents so markdowns show without extra setup.
• Business facts for agents. A knowledge base in the admin lets merchants review and approve the policies and FAQs that get shared with agents, which is what the Ask MCP ask_business tool answers from.
• WebMCP on the storefront. Online stores register structured WebMCP tools so an agent running in the buyer's browser can discover products, create carts and move through checkout.
• Catalog API. Search results can be filtered to products with 3D models or video, and the Catalog API can now return products from businesses on and off Shopify (in beta), with the Shopify-specific filters and fields documented in the Global Catalog extension. Cart and checkout permalinks can carry products, customer details, discounts and attribution through the UCP /buy endpoint.

For UK merchants the practical question is whether the store is Catalog-eligible and whether its policies read correctly when an agent quotes them. Both are now checkable from the admin. Our UCP defaults post explains what Shopify publishes on a store's behalf and where you can override it.

Rollouts: scheduled launches with a read API

Rollouts bundle a theme, a checkout and accounts configuration, catalogues and discounts into one scheduled change, A/B test or temporary event. The help page walks through creating one from Markets, Rollouts, and Shopify says the reach now extends to headless builds, Shopify POS, Google Shopping and the Shop app. Catalog changes to prices and publishing can roll back automatically when a promotion ends.

On the API side, the 2026-10 Admin GraphQL release added a root rollouts query and rollout(id:), exposed schedules, configured and effective traffic allocation and the resources each treatment changes, and introduced six rollouts/* webhook topics. Apps request the read_rollouts scope, and existing installs may need the merchant to reauthorise. If your app reads discounts, Shopify has separate guidance on handling discount Rollouts.

Security deadlines every app owner should diary

The Developer section is unusually firm about dates. These are the ones from Shopify's own documentation:

• Script tags. Shopify's migration page is explicit: move storefront JavaScript to theme app extensions, use a web pixel if the script only collects analytics or conversion data, and use customer account UI extensions for the Order status page, where script tags stopped on 26 August 2026.
• Expiring tokens. An expiring offline token lasts one hour and Shopify rotates the refresh token on every use. Apps can also use client credentials to obtain access tokens themselves.
• IP allowlists. From the Dev Dashboard you can restrict which IP addresses may call the API for each app: up to 100 addresses or CIDR ranges, /16 or narrower for IPv4, public addresses only, with a test against the last 30 days of traffic before you turn enforcement on.
• App Store trust. App names must be unique, reviews are checked against shop trust and activity, and your organisation details are shown on collaborator access requests.
• AI Toolkit security check. A single prompt scans an app for vulnerabilities and works with your agent to fix them.

If you run a public app, the token migration and the script tag removal are the two items to schedule now. We cover the storefront side in our web pixels guide.

Platform primitives for apps

• Official PHP and Python packages. shopify/shopify-app-php and shopifyapp reached 1.0 on 26 August 2026 with request verification, token exchange and an Admin GraphQL client. The older shopify-api-php and shopify_python_api libraries are deprecated and will not get security fixes.
• Checkout Kit v4. The successor to Checkout Sheet Kit speaks UCP's Embedded Checkout Protocol, delivers live checkout state updates and a full Checkout snapshot on completion, redacts buyer data unless the merchant grants a scope, and consolidates the iOS, Android and React Native repositories.
• Polaris web components. 14 new component APIs on the Polaris CDN, with a versioned CDN so an app can follow, pin or preview a release.
• Analytics. Apps can send app events that merchants analyse next to store data, and write AnalyticsAnnotation records through the Admin API so a report shows which app changed what.
• Inventory and returns. Purchase orders are queryable through the Admin API, and returns now include automatically calculated taxes on shipping fees.
• Functions. Delivery customisations can read metafields on delivery options, and Shopify says Functions on the 2027-01 release will be able to read metaobjects per checkout, marked coming soon.
• POS extensions. A Printing API for receipts and labels, persistent background extensions that react to completed transactions, and a shared Storage API across targets.
• Dev Dashboard and CLI. A redesigned Dev Dashboard with billing and payouts, a store index that combines every store type, and a Shopify CLI tuned for non-interactive use so agents can create, list and delete dev stores. Production log queries from the CLI are coming soon. Events now cover 18 topics.
• App Pricing. A migration tool from the Billing API, unlimited private plans with any number of stores, localised estimated prices in listings, and an annual plan with monthly usage charges described as coming soon. Shopify also announced a partner earning model that pays on subscription revenue and online GMV for every business a partner brings, on all plans, for four years.

Storefronts: a new theme architecture, Canvas and Hydrogen

The Liquid July '26 developer preview adds two tags. {% block %} renders a reusable theme block directly from a template, and {% partial %} defines a server-rendered region that JavaScript can refresh without a full page load. Editions describes the result as pages composed in Liquid with blocks, typed contracts and partial updates, with Tailwind styling built in, and the developer preview is the way to try it. Existing themes keep working with sections, settings and JSON templates.

Two Markdown files travel with a theme. The agentic workflows page defines AGENTS.md, which explains how the theme is built, and DESIGN.md, which records design intent. Sidekick reads them before it changes a theme in Canvas, and your local coding agent reads the same files, so a decision made in the admin comes back to you on the next pull.

Canvas, announced on 1 October 2026, is the new way to edit an online store: the whole store in one view, zoom to any detail, and Sidekick turning a brief into a custom design. Editions says it is built on the new theme architecture and quotes a 20% faster path from no theme to a launched store. For agencies, the honest reading is that routine theme tweaks will increasingly be done by merchants in Canvas, and the value moves to architecture, integration and the context files that make Sidekick behave.

On headless, Shopify positions Hydrogen as production-ready with customer accounts, predictive search, built-in agent skills and one-click deploys to Vercel. Vercel Shop is Vercel's Next.js template on the new Hydrogen SDK, and mock.shop ships an agentic reference library. Themes also load faster because Shopify now delivers only the CSS each page uses. Our Hydrogen on Vercel post covers the runtime side.

Checkout, Flow and admin changes you will be asked about

• Custom fields in checkout. Text inputs, date pickers, checkboxes and choice lists for delivery instructions or gift messages, built into the checkout and accounts editor with no app (rolling out soon). The help page is clear that they will not ship before or during Black Friday Cyber Monday, there is no early access, and they will also work in agentic storefronts with direct checkout. All field types are Plus only; other plans get delivery instructions and gift message.
• Checkout layout. Payment methods move to a tiled layout (rolling out soon), a stacked form layout reduces scrolling (coming soon), and Apple Pay in Chrome, Edge and Firefox via a QR code is coming soon. Per-market fees on products and collections are in early access.
• Shopify Flow. Triggers now fire when a product price, tag, metafield or other field changes, admin roles control who can edit or activate automations, version history restores any previous workflow as a draft, and a store's own automations can be created, updated and activated by an external agent through the AI Toolkit; the underlying APIs are not open to third-party apps.
• Admin. A refreshed admin is rolling out with Sidekick as a floating prompt, passkey sign-in, a filterable change log attributing actions to staff, apps or services (coming soon), file folders, inline metafield editing and auto-generated store policies.
• Analytics. Bubble maps, annotations, category metafields and metaobjects as dimensions, and session counting with bot filtering and consent-aware visits. Expect reported sessions to move when this lands.
• Languages. Online stores can launch in Arabic, Hebrew and Urdu, and Shopify added 13 storefront and checkout languages including Ukrainian, Catalan and Tamil.

What is UK-specific in this release

• DHL Express labels in the admin for stores shipping from the UK, France, Italy, Germany or Spain. The help page marks it early access, and rates are not shown at checkout.
• Pickup points with Royal Mail. Shipping to a pickup point is available to stores in the UK, France, Italy and Spain, and the help page adds that eligible Shopify Plus stores can use it.
• Shop Campaigns opened to more than 35 new markets including the UK, Australia and the EU, paying only when an ad drives a sale.
• Shopify Protect is rolling out as an app for blocking fraud before it becomes an order, AI-written chargeback responses and custom risk rules. Shopify's announcement explains the approach, and Editions marks chargeback protection for non-Shop Pay orders as coming soon.
• Payments and POS. Alipay, WeChat Pay, Satispay, Scalapay and GrabPay join Shopify Payments, MB WAY and OXXO are available online, and printed POS receipts can auto-add UK, EU and Canada tax summaries.

What we are doing for clients this month

1. Audit script tags. List every write_script_tags use across client apps and themes, and plan the move to theme app extensions or web pixels before 1 March 2027.
2. Migrate tokens. Switch public apps to expiring offline tokens and client credentials well before 1 January 2027, then turn on an IP allowlist.
3. Plan Black Friday as a Rollout. Theme, checkout configuration, catalogue pricing and discounts in one scheduled change with automatic rollback, instead of a late-night manual switch.
4. Add AGENTS.md and DESIGN.md. Write the two context files for every theme we maintain, so Sidekick and our own agents follow the same architecture and design rules.
5. Check Catalog eligibility and agent facts. Run the eligibility page for each store, fix what it flags, and review the knowledge base answers an agent will quote.
6. Evaluate Checkout Kit v4 and Flow versioning. Native apps move to the new lifecycle events; Flow workflows get version history before anyone edits them in the run-up to peak. For the extensibility side, see our checkout extensibility service.

Everything above is taken from Shopify's Editions site, its news posts and shopify.dev on 2 November 2026. Shopify labels several items as early access, beta or coming soon, and availability can differ by plan and country, so check the linked page for your store before you commit a roadmap to it. If you want help working through the list for a Shopify or Shopify Plus store, our Shopify development team does this for UK merchants.