Card Deposit Endpoint Now Requires mTLS Certificate

Shopify now requires apps to use a Shopify-issued mTLS (mutual Transport Layer Security) client certificate when calling the card-deposit endpoint. The requirement takes effect October 15, 2026.

What Changed

Apps that store cardholder data using the customerPaymentMethodCreditCardCreate and customerPaymentMethodCreditCardUpdate GraphQL Admin API mutations must deposit that data at Shopify’s /sessions card-deposit endpoint to receive a session identifier. Starting October 15, 2026, all deposit requests must present a Shopify-issued mTLS certificate. Requests without the certificate will fail after enforcement begins.

Impact on Shopify App Developers

This change affects any app that handles credit card data through Shopify’s payment method APIs. Developers must obtain and configure a Shopify-issued client certificate for their applications before the October 2026 deadline. Apps that fail to implement mTLS authentication will lose the ability to deposit card data and create or update customer payment methods.

Implementation Requirements

Developers need to request an mTLS certificate from Shopify and configure their applications to present this certificate when making calls to the card-deposit endpoint. The certificate-based authentication adds an additional security layer beyond standard API authentication, ensuring that only verified applications can deposit sensitive cardholder data to Shopify’s systems.

Apps currently using these payment method mutations should begin the certificate implementation process well before the October 2026 enforcement date to avoid service disruptions.

Read the full announcement →