Global Catalog REST Has Been Discontinued, Offline Tokens Will Expire Next Year

Starting November 2, the Global Catalog REST API will no longer serve any traffic. All requests to discover.shopifyapps.com/global/... will fail directly, including queries for saved catalogs. When it was deprecated in April, the official alternative, Global Catalog MCP, was provided, and the six-month window has now expired.

On the other hand, next year. On October 27, Shopify set a hard deadline for the enforcement timeline of offline tokens: public apps that have not migrated will be removed from the App Store on January 1, 2027, and starting April 1, old tokens will return HTTP 403. Both tasks require code changes; one is urgent today, while the other has two months left—don’t treat it as non-urgent.

The Endpoint That Went Down Yesterday

The Global Catalog REST API was marked as deprecated in April 2026, with its replacement, Global Catalog MCP, implementing the Universal Commerce Protocol (UCP). After November 2, all four endpoints will cease operations:

• GET /global/v2/search
• GET /global/v2/p/{upid}
• GET /global/v2/p/by-variant/{vid}
• POST /global/v2/lookup

The most directly affected are apps that aggregate across stores. For instance, a team that compares pet supplies has stored two hundred monitored products in their selection tool, using /global/v2/lookup nightly to pull the latest prices in bulk, providing users with comparison reports in the morning. After November 2, the first request for this task will fail, leaving the report empty, and merchants will notice that prices have stopped updating that day. Price comparison, site-wide searches, and cross-store sourcing functionalities relying on this catalog interface will lose their data source on the same day.

Saved catalogs will also be affected. It is unclear whether there will be a buffer after the service stops or if old addresses will redirect; the official documentation only states that it stops serving traffic. I am treating it as if there is no buffer, and scheduled tasks that are still hitting this domain should now be receiving alerts.

The Replacement Method

The core task is to replace the four REST calls with three UCP tools, sending requests to https://catalog.shopify.com/api/ucp/mcp:

• Search → search_catalog, supports filtering, pagination, and buyer context
• Single product and variant → get_product, identifiers passed as gid://shopify/p/{upid} or gid://shopify/ProductVariant/{id}
• Bulk → lookup_catalog, up to 50 at a time

Two easily overlooked details: each request must include meta.ucp-agent.profile, with the value being the agent profile URL; for querying saved catalogs, change to passing catalog.catalog_id, and do not concatenate the old endpoint URL anymore.

The authentication method remains unchanged, still using client credentials from the Dev Dashboard to exchange for a bearer token.

If you want to test before making changes, run a ucp catalog search using the UCP CLI, which can be found at github.com/Shopify/ucp-cli. I have not yet tested the error patterns of UCP in real traffic, so it’s uncertain; it’s best to run it in a testing environment before switching to production.

Changelog: https://shopify.dev/changelog/posts/global-catalog-rest-api-stops-serving-traffic-on-november-2-2026

Three Dates for Tokens, Only January 1 is Mandatory for You to Act

This issue has been building since the beginning of the year: starting April 1, 2026, newly created public apps will have expiring tokens enforced, and on May 20, the changelog expanded this to all public apps. At that time, only January 1 was given, but on October 27, the official timeline was completed:

• January 1, 2027: Apps that have not migrated will be removed from the App Store and prohibited from new installations, while existing installations will continue to work.
• January 15, 2027: Merchants will see warnings in the Shopify admin.
• April 1, 2027: Non-expired offline token requests to the Admin API will return HTTP 403.

The official statement is straightforward: January 1 is the migration deadline, while the latter two dates are a buffer for merchants, not an extension for you. Code must be completed by December 31.

Why the tight timeline? The official reason is the radius of exposure. Non-expired tokens, once leaked, remain permanently valid, with no upper limit on the attack window; expiring tokens expire after 60 minutes and are automatically rotated, limiting the impact to within an hour. It’s important to clarify the scope: affected are public apps calling the Admin API; custom apps, merchant-built apps, and online access tokens are not included. Many teams inadvertently publish internal tools as public apps, which are the easiest to overlook, so it’s worth conducting a self-check before proceeding.

Migration is lighter than expected. Merchants do not need to reinstall; simply exchanging the existing token in the code will switch it; the official templates and API libraries have already implemented refresh, and the only tasks left are token exchange and storage updates. Guide: https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens

At the end of October, there’s also a useful fallback: client credentials access. Previously, if a refresh token was lost, merchants had to wait for the app to be reopened; now the backend can directly exchange for a new access token using the app’s private key signature. For older apps installed in over a thousand stores, this fallback is worth the migration cost.

Handy Tips

The same announcement also provided two low-cost switches: the addition of a [network_access] section in shopify.app.toml to declare the servers and sites the app accesses; the Dev Dashboard now supports IP allowlisting. Run shopify app security check before release.

Schedule

For those still adjusting to REST, there is no schedule; the endpoint is already dead, and today is migration day. For those using non-expired tokens, schedule the migration for Q4, and don’t wait until January when merchants start seeing warnings and support tickets come in before taking action.