Shopify App Automation Tokens 2026: CI/CD Migration Guide For Hydrogen Teams

On May 6, 2026, Shopify quietly shipped one of the most important changes to the app developer workflow in years: CI/CD app deployment is now available for every app, not just Plus partners. The mechanism is a new credential type called App Automation Tokens, created in the Dev Dashboard, scoped to a single app, and authenticated through one environment variable.

If you missed it in the changelog noise, you're not alone — it landed two weeks before the louder CLI 4.0 release. But for teams shipping Hydrogen storefronts alongside custom Shopify apps (storefront proxy apps, B2B catalog gates, custom checkout extensions, admin tools), this is the credential migration that needs to be on next sprint's roadmap.

Here's what changed, the exact migration path, and why the new token model is genuinely better security than what you had before.

What actually shipped

Three things you need to understand:

1. App Automation Tokens are scoped to individual apps

Old Partner Dashboard CLI tokens (SHOPIFY_CLI_PARTNERS_TOKEN) were org-wide. One leaked token = exposure across every app under that partner account. App Automation Tokens are scoped to the single app where they're created. A leak compromises one app, not your entire portfolio.

For agencies and consultancies running multiple client apps from the same partner org, this is a meaningful security upgrade. Each client deployment pipeline gets its own credential. Rotation can happen per-app without disturbing other teams.

2. Token creation moved to the Dev Dashboard

Old flow: Partner Dashboard → Settings → CLI tokens. New flow: Dev Dashboard → open your app → Settings → App Automation Token → Create token. Pick an expiration period (1 month, 3 months, or 6 months), generate, copy immediately. The token value is only visible once — if you lose it, you revoke and regenerate.

You can no longer create new tokens in Partner Dashboard. Existing Partner Dashboard tokens continue working until they expire, but new pipelines need the new flow.

3. The environment variable changed

Your CI/CD pipeline needs to read SHOPIFY_APP_AUTOMATION_TOKEN instead of SHOPIFY_CLI_PARTNERS_TOKEN. The Shopify CLI auto-detects this variable and uses it for non-interactive auth.

# OLD
export SHOPIFY_CLI_PARTNERS_TOKEN="your-partner-token"
shopify app deploy --config production

# NEW (paired with CLI 4.0 from last week)
export SHOPIFY_APP_AUTOMATION_TOKEN="your-app-automation-token"
shopify app deploy --config production --allow-updates

bash

If you migrated to --allow-updates after the CLI 4.0 release on May 21 (replacing the deprecated --force flag), the deploy command itself stays the same — you're only swapping the env var name.

The exact migration path

For a Hydrogen team running multiple apps under one partner org, here's the safe sequence:

Step 1 — Generate the new token in Dev Dashboard

Open dev.shopify.com/dashboard/, navigate to your app, go to Settings, find the App Automation Token section, click Create token. Pick a 6-month expiration if you want fewer rotation cycles, or 1 month if you're stricter about credential hygiene.

Copy the token value immediately. It will never be visible again.

Step 2 — Add the new secret to your CI/CD provider

For GitHub Actions: Settings → Secrets and variables → Actions → New repository secret. Name it SHOPIFY_APP_AUTOMATION_TOKEN. Paste the value. For CircleCI, Bitbucket Pipelines, GitLab CI: equivalent secret/variable management in your project settings.

Do not remove the old SHOPIFY_CLI_PARTNERS_TOKEN secret yet. You want both available during the transition.

Step 3 — Update your workflow file

In your .github/workflows/deploy.yml (or equivalent), update the environment block:

- name: Deploy Shopify app
  env:
    SHOPIFY_APP_AUTOMATION_TOKEN: ${{ secrets.SHOPIFY_APP_AUTOMATION_TOKEN }}
  run: |
    npm install -g @shopify/cli@^4.0.0
    shopify app deploy --config production --allow-updates

yaml

The explicit npm install -g @shopify/cli@^4.0.0 line guarantees you're on the version that knows about the new auth. The --allow-updates flag is the CLI 4.0 replacement for --force.

Step 4 — Run one staging deploy with the new token

Push a no-op change to a staging branch. Watch the CI run. If the deploy completes without auth errors, the new token is wired correctly.

Step 5 — Revoke the old Partner Dashboard token

After the new token has shipped a successful production deploy, return to Partner Dashboard → Settings → CLI tokens, find the old token, click Revoke. You can also clean up the SHOPIFY_CLI_PARTNERS_TOKEN secret from your CI/CD provider.

Why the new model is actually better

Three quiet improvements that matter once you're operating at any real scale:

Built-in rotation workflow. Click Rotate in the Dev Dashboard, pick a new expiration, get a new token. The old and new tokens are both valid until you revoke the old one. That window lets you update every CI/CD environment without a hard cutover, then revoke when you're confident. Old tokens had no clean rotation story — you generated a new one and prayed nothing pointed at the old.

Forced expiration. Maximum 6 months. This is a security floor that most teams wouldn't enforce on themselves. Tokens that never expire become tokens nobody remembers exists, sitting in old GitHub secrets, occasionally getting leaked into log files. Built-in expiration forces hygiene.

App-scoped blast radius. A leaked token reveals one app's deploy capability, not every app under the partner org. For agencies running 10–20 client apps, this changes the threat model entirely. Before, one careless contractor with one leaked token could push a malicious version of any app in the org. Now, the leaked token's reach is bounded to exactly the app it was created for.

What this means for Hydrogen teams specifically

If you ship Hydrogen storefronts that depend on companion apps — and most serious headless builds do — you're now operating in a world where:

CI/CD is no longer a Plus-tier privilege. Every developer, every freelancer, every small agency can wire up automated deploys with first-party Shopify tooling. The friction is gone.
Token hygiene is enforced, not aspirational. The platform handles expiration and rotation. Teams that previously couldn't justify the engineering time for a rotation workflow now get one for free.
Per-app credential scoping aligns with how Hydrogen + apps are typically architected. One storefront, one (or two) companion apps, each with its own deploy pipeline and its own credential. The new token model matches the architecture.

The teams shipping serious Hydrogen storefronts in 2026 increasingly look like small platform-engineering teams: pinned CLI versions, locked-down CI/CD, separated staging from production runs, per-app credentials, scheduled token rotation. App Automation Tokens make that posture the default instead of the exception.

The Hydrogen + companion-app deploy checklist for this week

Grouping yesterday's CLI 4.0 migration with this week's token migration, here's the consolidated state every Hydrogen team should be in by end of next week:

CLI pinned to ^4.0.0 in package.json and explicit install step in CI
All --force flags in deploy pipelines replaced with --allow-updates
App Automation Tokens generated for every app in your portfolio (Dev Dashboard, not Partner Dashboard)
CI/CD secrets updated to use SHOPIFY_APP_AUTOMATION_TOKEN (one per app, not one shared org token)
A staging deploy successfully run with the new credential chain
A note in your runbook for the rotation date (3–6 months out, depending on the expiration you picked)
Old Partner Dashboard CLI tokens revoked once confirmed unused

For teams running 5+ apps, the token-generation step is the only slow part — budget 30 seconds per app in the Dev Dashboard UI, plus the time to wire each new secret into CI/CD. It's a half-day of work for a meaningful long-term security upgrade.

The bottom line

App Automation Tokens are a small change with a long shadow. The deploy command barely changes. The CI/CD pipeline barely changes. What changes is the security and operational posture of every app deploy your team runs — per-app scoping, enforced expiration, clean rotation, no more org-wide blast radius.

Paired with the CLI 4.0 release from last week, Shopify has now landed the cleanest app-deploy story they've ever shipped. If your Hydrogen + companion-app stack is still on Partner Dashboard tokens and --force flags, the migration to the new state is a one-afternoon job that pays back every time a credential gets rotated, audited, or revoked.

If your team is running Hydrogen storefronts with multiple companion apps and the deploy + secrets management surface is one of your active engineering tracks, the Weaverse team takes on Hydrogen engagements end-to-end including CI/CD hardening, credential migration, and per-app deploy isolation. Senior engineers, fast scoping, deep platform fluency on the moving Shopify CLI, app deploy, and Hydrogen release cadence. Talk to us →