Shopify scriptTagCreate Permission Error After October 1, 2026: What Changed
Starting October 1, 2026, Shopify blocks creation and updates of storefront ScriptTags. GraphQL scriptTagCreate and scriptTagUpdate return a permission error on every API version; REST ScriptTag POST and PUT fail too. An older API version cannot avoid this change. Existing storefront tags keep running until March 1, 2027, when Shopify stops injecting them. Read and delete operations remain available. If your create or update call began failing at this cutoff, check the operation and response before treating it as a token problem. Choose an app embed block for storefront JavaScript or a Web Pixel for analytics, then verify the replacement before removing the old tag. Admin-created custom apps need a separate fallback.
Shopify’s storefront deprecation guide documents the behavior above. We have not reproduced the permission error in a live store, and the guide does not specify a stable exact error message to match.
Is this a permissions bug or the October cutoff?
First identify the operation. The scheduled restriction covers GraphQL scriptTagCreate and scriptTagUpdate, plus REST ScriptTag POST and PUT. It applies across API versions. Changing versions does not restore those writes. Official cutoff
Our diagnostic recommendation: preserve the response and confirm that the failing call belongs to this surface. A permission error from a different endpoint, or one observed before the cutoff, needs its own investigation. Do not treat every authorization failure as deprecation evidence.
The scope is storefront ScriptTags. Check display_scope: records involving order_status or all also require the separate Order status migration guidance linked from Shopify’s overview.
What still works, and when does it stop?
There are two different deadlines:
- October 1, 2026: creation and updates stop. Existing storefront tags continue to execute; read and delete operations remain usable.
- March 1, 2027: Shopify stops injecting storefront ScriptTags. Features still loaded only through that mechanism stop loading.
The October change can therefore affect onboarding a new store even while an existing installation appears healthy. Successful execution of an old tag does not establish that your app can create the next one. Shopify timetable
Which replacement fits your script?
For JavaScript that adds storefront behavior or UI, build a theme app extension with an app embed block. For analytics, conversions or customer behavior collection, Shopify directs developers to Web Pixels. A pixel is a different integration surface; use the documented pixel APIs and permissions. Replacement guidance
App embed blocks work with vintage themes as well as Online Store 2.0. Do not confuse them with app blocks that require supporting JSON templates. Storefront guide
If a service maintains the integration, ask that provider which replacement it is shipping and what activation the merchant must perform. This article does not verify any provider’s rollout.
Why installing the extension is not enough
An app embed is inactive until the merchant enables it. It is enabled per theme, so verify it on the published theme and recheck when a different theme is published. Your app cannot activate it on the merchant’s behalf. Theme extension migration
The migration guide documents activation checks through the App API in Shopify Admin, or through the published theme’s settings with the required theme access. A deployed extension and an active replacement are different states.
Shopify currently says the previously planned install-warning banner will not appear. A missing warning is therefore not evidence that an app has completed migration. Current storefront notice
What if this is an admin-created custom app?
Apps created directly in Shopify Admin cannot use app extensions, including theme app extensions and Web Pixels. This distinction concerns how the app was created; do not apply it to every custom-distributed app. Shopify’s fallback guidance
For an app you maintain, Shopify recommends moving the script into the theme, preferably through a custom Liquid block where possible, or through the code editor. Theme code can remain after app removal, and editing it can affect automatic upgrades. For an agency or third-party integration, the maintainer must supply the replacement. Treat direct theme editing as this documented fallback rather than the default migration for extension-capable apps.
What should you do now?
Use this operational checklist with the official migration procedure:
- Inventory your app’s tags and their display scopes for each affected store.
- Assign the correct replacement and the team responsible for it.
- Build and deploy the replacement; for an embed, send the merchant to the theme editor with a deep link.
- Confirm activation on the published theme and test the actual storefront feature.
- Remove the old ScriptTag only after the replacement works. Minimize overlap: both running together can duplicate UI or analytics.
- Record stores still waiting for activation and recheck theme changes before March 1, 2027.
After October 1, you cannot recreate a deleted tag as a rollback path. Plan validation before cleanup. This is an operational implication of the write restriction, not a separate Shopify recovery guarantee.
Separate Global Catalog retirement
If your integration also calls discover.shopifyapps.com/global/..., use the Global Catalog REST to MCP migration checker to review that separate November 2, 2026 cutoff. This does not resolve scriptTagCreate permissions.
Primary sources
- Shopify: storefront ScriptTag cutoff and replacement pathsofficial documentation
- Shopify: ScriptTag deprecation announcementofficial announcement
- Shopify: migrate to theme app extensions and verify activationofficial documentation
- Shopify: ScriptTag deprecation overviewofficial documentation
Frequently asked questions
Why is scriptTagCreate returning a permission error?
Shopify disabled storefront ScriptTag creation and updates on October 1, 2026 across all API versions. Confirm the failing operation before attributing other permission errors to this change.
Do existing storefront ScriptTags still work?
Yes. The October cutoff affects writes. Shopify says existing storefront tags keep running until March 1, 2027; Order status tags have a separate schedule.
Can an older API version restore create or update calls?
No. Shopify applies the restriction to every API version.
Should I use an app embed block or a Web Pixel?
Use an app embed block for storefront JavaScript and a Web Pixel for analytics, conversions or customer behavior. Check whether your app can use extensions first.
Can my app enable the app embed for the merchant?
The migration guide says your app cannot activate it on the merchant’s behalf. Use a theme-editor deep link and verify activation on the published theme.
What if the app was created directly in Shopify Admin?
Admin-created custom apps cannot use app extensions. The maintainer needs to move the script into the theme or provide a replacement app, following Shopify’s fallback guidance.