Shopify mTLS: mandatory certificate for card vaulting

What changes with Shopify's mTLS requirement

Starting October 15, 2026, Shopify will require a client certificate issued directly by Shopify for every call to the /sessions endpoint used for card data vaulting. The endpoint itself doesn't change technically: it's the same URL, the same call structure. What changes radically is access control: from that date onward, only callers authenticated via an mTLS certificate will be able to interact with the card vaulting system.

This change is part of a broader tightening of security around payment flows, but it has a particularity that makes it urgent for anyone developing or managing payment apps: the deadline deliberately coincides with the pre-BFCM 2026 period, the peak moment for global ecommerce.

Who is actually affected

Not all integrations are affected in the same way. It's essential to distinguish between two scenarios:

• Affected apps: those that use the customerPaymentMethodCreditCardCreate or customerPaymentMethodCreditCardUpdate mutations to save card data directly into Shopify's vault. These apps will be required to obtain and present the mTLS certificate.
• Excluded apps: those that only use customerPaymentMethodRemoteCreate to import references from external gateways such as Stripe, Braintree, Adyen, or PayPal. In this case, no action is required, since the flow doesn't touch the direct deposit endpoint.

The distinction is technical but decisive: many apps might think they're affected when in fact they operate only through external references, or conversely, underestimate the impact because they haven't yet precisely mapped which mutations are actually called in their code.

Why the timing is critical

The most significant point of this change isn't so much the technical complexity of implementation, but rather the timing chosen by Shopify. Setting the deadline right before Black Friday Cyber Monday 2026 means that an expired, unrequested, or not-yet-issued certificate at the wrong moment immediately blocks new card deposits.

The practical consequences of a block during this period are severe:

• Interruption of recurring subscriptions that require new payment methods
• Blocking of B2B billing flows that rely on direct vaulting
• Inability to register new cards during the year's peak traffic and conversion period

Anyone managing revenue based on subscriptions or B2B payments can't afford to discover this problem in October 2026.

Operational steps to take right away

For anyone developing or maintaining an app with card vaulting on Shopify, the migration path requires a few specific steps:

1. Verify which mutation your app actually uses, distinguishing between direct deposit and remote reference.
2. Contact Shopify at shopify-mtls-partnerships@shopify.com, providing the API client ID and a technical contact from your organization.
3. Account for issuance times: the first certificate is signed manually by Shopify, so the process takes days, not hours. This is the main bottleneck of the entire migration.
4. Update the call flow: the certificate must be presented on the /sessions call, while the session identifier continues to be passed to the vaulting mutations exactly as before.
5. Set up monitoring for the annual certificate expiration. Rotation is self-serve but not automatic, so an internal alert is needed to avoid future disruptions caused by expired certificates.

Impact on technical teams and development roadmaps

For teams managing custom payment integrations, this change calls for a review of the Shopify app maintenance cycle, including periodic checks on certificate validity and documented renewal procedures. Those who rely on external expertise to manage these integrations may want to consider dedicated resources such as those described on the Shopify developer pricing page, useful for planning technical adjustments before the deadline.

Conclusion

Apps that haven't completed the migration by October 15, 2026, will lose the ability to deposit new card data into the Shopify vault once enforcement is activated. Since the slowest phase of the entire process is Shopify's issuance of the first certificate, anyone managing apps with card vaulting should start the request procedure well ahead of the deadline, avoiding being caught unprepared during the most critical period of the year for ecommerce.