Shopify Payment-Related Applications Notice: mTLS Migration Must Be Completed by October 15

On July 16, Shopify announced a change related to payment data security in its developer update log: applications that deposit cardholder data into Shopify in a specific manner must complete the mTLS migration by October 15, 2026.

This change does not apply to all Shopify applications, nor will all payment applications be affected. More specifically, it impacts applications that submit raw credit card holder data to the Shopify card-deposit endpoint.

If your team maintains Shopify payment applications, subscription migration tools, payment method import tools, or provides custom development for DTC brands, this change is worth checking as soon as possible.

What are Shopify’s Specific Requirements?

According to Shopify’s official changelog, the Shopify card-deposit endpoint now requires requests to carry an mTLS client certificate issued by Shopify.

The endpoint in question is: https://checkout-mtls.pci.shopifyinc.com/sessions

This endpoint itself has not changed; the change is that in the future, every request submitting cardholder data to it must include the mTLS client certificate issued by Shopify.

Shopify has set the migration deadline for October 15, 2026. After this date, if a request does not have a valid certificate, the related deposit requests will be rejected. Applications that have not completed the migration will not be able to continue depositing new cardholder data into Shopify.

Which APIs/Applications Will Be Affected?

The affected applications are those that submit cardholder data through the Shopify card-deposit endpoint and subsequently call the following GraphQL Admin API mutations:

• customerPaymentMethodCreditCardCreate
• customerPaymentMethodCreditCardUpdate

Both types of mutations rely on sessionId. This sessionId comes from the application first submitting card data to Shopify’s /sessions card-deposit endpoint.

A typical flow can be understood as follows: the application processes raw card data in a PCI-compliant environment; submits the card data to Shopify’s /sessions endpoint; Shopify returns a session identifier; the application then calls customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate, passing the session identifier to Shopify.

Such scenarios typically occur in saving cards, updating cards, subscription payment method migration, customer payment method onboarding, and other business processes.

Which Applications Are Not Affected?

Shopify has explicitly stated that customerPaymentMethodRemoteCreate is not within the scope of this change.

If the application only imports existing payment method references from external payment gateways, such as Stripe, Braintree, Authorize.Net, Adyen, or PayPal, and only calls customerPaymentMethodRemoteCreate, then no action is required regarding the mTLS requirements for the card-deposit endpoint.

The reason is that such calls import references to existing payment methods from external gateways and do not submit raw cardholder data to Shopify’s card-deposit endpoint.

What is mTLS?

mTLS stands for mutual TLS, which is mutual TLS authentication.

In regular HTTPS/TLS, typically, the client verifies the server’s identity. For example, when a browser accesses a website, it checks whether the website’s certificate is trustworthy. mTLS further requires both parties to verify each other: the client verifies the server’s trustworthiness, and the server also verifies the client’s trustworthiness.

In the context of Shopify payments, the significance of mTLS is that requests must not only be transmitted through an encrypted channel but also prove who is initiating the request.

Shopify also mentions in its payment extension technical requirements that payment extensions need to use mTLS to ensure secure and trustworthy two-way communication between Shopify and the payment extension. For requests initiated by Shopify to the payment application server for payment, refund, capture, void, etc., the payment application needs to verify that the request indeed comes from Shopify.

The focus of this changelog is slightly different: it addresses the requirement for applications to provide a client certificate issued by Shopify when submitting card data to the Shopify card-deposit endpoint, allowing Shopify to verify the identity of the submitter.

Why is Shopify Making This Migration?

Shopify’s official reason is straightforward: all cardholder data traffic reaching the card-deposit endpoint must be attributable to an authenticated caller.

In other words, Shopify wants to ensure that every card data request submitted to that endpoint can confirm its source.

This change is also described by Shopify as an important security preparation ahead of Black Friday and Cyber Monday in 2026. The mTLS client certificate is a prerequisite for Shopify to subsequently reject unauthenticated deposit traffic.

For applications handling payment data, this is also a reasonable direction for a security upgrade: increasing the recognizability of cardholder data submission traffic, reducing the risk of unauthenticated traffic entering sensitive endpoints, strengthening mutual trust in the payment chain, and establishing clearer operational requirements for certificate rotation and expiration monitoring.

Actual Impact on Developers and Service Providers

If the application is affected, the main impacts are concentrated in three areas.

1. Deposit Requests Need Modification

When calling the /sessions card-deposit endpoint, it is necessary to carry the mTLS client certificate issued by Shopify.

The existing GraphQL Admin API vault mutations remain unchanged. The calling methods for customerPaymentMethodCreditCardCreate and customerPaymentMethodCreditCardUpdate have not changed due to this change; they still pass the session identifier returned from the deposit call.

2. OAuth Process Is Not Affected

Shopify’s official documentation states that mTLS is not used to obtain OAuth access tokens. Requests using Shopify GraphQL mutations are still authenticated via OAuth access tokens. Do not interpret this change as an adjustment to the OAuth authentication method.

3. Certificates Will Become New Operational Objects

Shopify mentions that the initial certificate is manually issued by Shopify and typically takes a few days. After the initial certificate is completed, subsequent rotations can be self-serviced through Shopify’s Certificate Signing Service.

The certificate is valid for one year. Missing the rotation may lead to deposit halting, so the certificate expiration time needs to be included in monitoring, alerting, and release check processes.

Suggested Action Checklist

If you maintain Shopify payment-related applications, you can check in the following order.

Step 1: Confirm Whether Affected Mutations Are Called

Check the code, task scripts, migration tools, and background services for calls to customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate.

If there are any, continue to confirm whether raw card data will be submitted to Shopify’s /sessions card-deposit endpoint.

Step 2: Distinguish Remote Import from Card Deposit

If only customerPaymentMethodRemoteCreate is called and only imports existing payment method references from external gateways, according to Shopify’s current explanation, it is not within the scope of this mTLS migration.

If both remote import and credit card deposit logic exist, they need to be handled separately; conclusions cannot be drawn solely based on application names or business module names.

Step 3: Apply for Shopify-Issued Client Certificate

Shopify requires affected applications to apply for certificates at shopify-mtls-partnerships@shopify.com. The application must provide the API client ID and technical contact.

Since the initial certificate is manually issued by Shopify and takes a few days, it is not recommended to wait until October to handle this.

Step 4: Modify /sessions Deposit Call

When making requests to https://checkout-mtls.pci.shopifyinc.com/sessions, carry the certificate. After completing this, continue to pass the returned session identifier to the corresponding GraphQL Admin API mutation. The GraphQL mutation itself does not need to be adjusted for mTLS authentication due to this migration.

Step 5: Verification and Monitoring

After the migration is complete, it is necessary to confirm that deposit traffic has been accompanied by a valid certificate. Shopify will verify the cutover on its side.

It is also recommended to increase monitoring of certificate expiration times, deposit request failure rates, mTLS handshake failure alerts, certificate rotation process drills, and risk assessments for the freeze of the launch before October 15.

Reminders for Brands and Service Providers

If you are a Shopify merchant, DTC brand, or cross-border e-commerce team, you typically do not need to handle mTLS code migration yourself. However, if you are using custom payments, subscription migration, card saving, customer payment method migration, or other services, it is advisable to confirm with your service provider:

• Whether it involves customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate;
• Whether cardholder data is submitted to the Shopify card-deposit endpoint;
• Whether you have already applied for a Shopify-issued mTLS client certificate;
• Whether you can complete the launch and verification before October 15, 2026;
• Whether you have established monitoring for certificate rotation and expiration.

These changes may seem low-level, but if the deadline is missed, the impact could directly reflect on the business level: new card data cannot be stored, and subscription or customer payment method migration processes may be interrupted.

Summary

Shopify’s mTLS migration primarily imposes stricter identity authentication requirements on applications that submit cardholder data to the Shopify card-deposit endpoint.

The key focus should be on applications calling customerPaymentMethodCreditCardCreate, customerPaymentMethodCreditCardUpdate, and relying on the /sessions deposit process to obtain session identifiers.

If the application only uses customerPaymentMethodRemoteCreate to import payment method references from external gateways, according to Shopify’s current explanation, no action is required regarding this change.

The deadline is October 15, 2026. Considering that the initial certificate needs to be manually issued by Shopify and that verification and monitoring need to be incorporated after launch, it is advisable for relevant teams to check, apply for certificates, and complete gray verification as early as possible.

References

• Shopify Developer Changelog: Card deposit endpoint now requires mTLS certificate (2026-07-16)
• Shopify Developer Changelog: mTLS client certificate renewal for Payments Apps (2026-04-16)
• Shopify GraphQL Admin API: customerPaymentMethodCreditCardCreate / customerPaymentMethodCreditCardUpdate / customerPaymentMethodRemoteCreate
• Shopify Payments Apps implementation considerations