Shopify + ERPNext in 2026: what changed, and how to keep orders flowing.

If your Shopify store sends orders to ERPNext, Shopify's platform changes over the last two years affect how that connection is built. Integrations set up the old way keep working for now. But the first time you create a new app, rotate credentials or move to a new store, you'll be on the new model, and it works differently.

1. Legacy custom apps: no new ones after 1 January 2026

For years, the usual way to connect a Shopify store to ERPNext was a custom app created in the Shopify admin. You chose the API scopes, clicked install and copied an Admin API access token starting with shpat_. That token never expired, and many connectors were built around it.

Since 1 January 2026, Shopify no longer lets you create new legacy custom apps in the admin. Apps created before that date keep working, and their tokens stay valid. New apps are created in Shopify's Dev Dashboard (or with Shopify CLI), which Shopify describes as having access to the full app platform rather than the smaller feature set of admin-created custom apps.

What this means for you: if your ERPNext integration runs on a shpat_ token from a legacy custom app, nothing breaks today. But if that app is ever deleted, its token is revoked, or you open a second store, you can't create another one the old way.

2. Dev Dashboard apps: client ID, secret and 24-hour tokens

A Dev Dashboard app gives you a Client ID and a Client secret instead of a ready-made token. For a server-side integration like ERPNext, the simplest option is the client credentials grant: your integration sends the ID and secret to the store's token endpoint and gets an access token back.

POST https://{shop}.myshopify.com/admin/oauth/access_token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=…&client_secret=…

The response includes the access token, the scopes granted, and expires_in, which Shopify documents as always 86399 seconds, or 24 hours. After that the token stops working, and the integration must request a new one by making the same call again.

An integration that stores a token once and expects it to work forever will fail a day after setup. A 2026-ready connector caches the token, refreshes it before it expires, and retries once with a fresh token if Shopify rejects a request.

The catch: same organization only

Shopify's documentation is explicit: the client credentials grant only works when the app and the store belong to the same Shopify organization, and can't reach a store outside it, including a client's store. Owning or installing a store doesn't automatically put it in your organization.

In practice there are two clean ways to set this up:

• The store's own organization creates the app. The merchant, or a developer working inside the merchant's organization, creates the app in the Dev Dashboard, and the client ID and secret are entered into ERPNext. This is the simplest option for a single store connecting to its own ERPNext.
• A different grant. For an app that must serve stores outside your organization, Shopify points to custom distribution with the authorization code grant (or token exchange for apps embedded in the Shopify admin). It's more setup, but designed for that case.

If you see a shop_not_permitted error when requesting a token, the app and store are almost certainly in different organizations.

3. REST is legacy: build on the GraphQL Admin API

Shopify marked the REST Admin API as legacy on 1 October 2024, and from 1 April 2025 new public apps had to use the GraphQL Admin API exclusively. Existing integrations can still call REST, but new capabilities, like Shopify's newer product and variant model, arrive in GraphQL, and REST is on its way out.

For an ERPNext integration, that means reading orders and customers and writing products and inventory through GraphQL. One GraphQL detail catches people out: the productSet mutation updates only the fields you send, but list fields such as variants are replaced by what you send. Push a product with one variant onto a Shopify product that has three, and the other two are deleted, along with the SKUs your orders map to. Model each sellable variant carefully before you let ERPNext push products.

What a 2026-ready Shopify ↔ ERPNext connector should do

Beyond the authentication change, these are the behaviours we treat as essential for any integration you rely on for revenue:

1. Manage the token lifecycle. Request, cache and refresh the 24-hour token automatically, with nothing for your team to rotate.
2. Webhooks with a safety net. Receive orders/create and related webhooks, verify each one's HMAC signature, respond to Shopify at once and process in the background. Also poll on a schedule, because webhooks can be delayed or missed.
3. Never create duplicates. Map each Shopify order ID to one ERPNext document, so replayed webhooks and overlapping polls are harmless.
4. Retry and alert. When an order fails, for example because of an unknown SKU, record it, alert someone, and retry until it succeeds rather than letting it age out.
5. Handle protected customer data. Shopify only shares customer names, emails and addresses with apps approved for protected customer data. Until approval arrives, orders should still import against a default customer.
6. Log everything. Every sync, payload and error should be recorded, so "where's order #2041?" takes seconds to answer.

Decisions on the ERPNext side

The Shopify changes are about how you connect. How orders land in ERPNext is a business decision you make once:

• Sales Invoice or Sales Order? Invoice directly if you ship immediately. Create a Sales Order if you need picking, approval or partial delivery.
• Stock on the invoice or on delivery? If you ship from stock, the invoice can move inventory. If you make or pack after the order, post the sale on the invoice and move stock on the Delivery Note.
• Which system owns products? Keep the catalogue in Shopify and only pull orders, or manage products in ERPNext and publish them. Pick one owner.
• SKU = item code. Matching Shopify SKUs to ERPNext item codes, with barcode as a fallback, keeps order lines resolving to the right items.
• Taxes, shipping and payments. Decide how shipping is charged, which tax templates apply, and which clearing account each payment gateway posts to.

Moving an existing integration to the new model

1. In the Dev Dashboard, create an app in the store's own organization with only the scopes you need, for example read_orders, read_customers, read_inventory, and write scopes only if ERPNext pushes products or stock.
2. Request protected customer data access if you need customer names and addresses.
3. Install and configure the new connector on a staging copy of ERPNext, and test real order types: discounts, shipping, cancellations and multi-item orders.
4. Switch off the old integration, register the new webhooks, and let the scheduled poll pick up any orders placed in between. Idempotent imports make this overlap safe.
5. Reconcile Shopify against ERPNext order by order for the first days, so you know nothing went missing.

Sources

• Shopify: Authenticate an app for stores in your organization (client credentials grant)
• Shopify: Get API access tokens for Dev Dashboard apps
• Shopify Developer Community: Starting January 1, 2026, you will not be able to create new legacy custom apps
• Shopify changelog: Starting April 2025, new public apps must use GraphQL
• Shopify Partners blog: All in on GraphQL