New trusted vault origin signal in Payments Apps API
Source: Shopify Dev Changelog
New Trusted Vault Origin Signal in Payments Apps API
Shopify has introduced a new field in the Payments Apps API 2027-01 release candidate that signals when a credit card originates from a vault Shopify trusts. The addition targets payment app developers handling card verification and processing flows.
What Changed
The release candidate adds payment_method.data.trusted_vault_origin, an optional Boolean field, to both credit card payment and verification requests. Shopify can include this field in two payload types: encrypted card payloads and payment_instrument payloads. Developers should read the field from payment_method.data, positioned outside the encrypted card details block.
The field exists specifically to help payment apps handle cases where CVV data is missing. When a card originates from a vault that Shopify trusts, the CVV may not be present, and trusted_vault_origin gives payment apps a way to identify and handle this scenario programmatically rather than treating it as an error or incomplete submission.
Why This Matters for Developers
Payment apps that enforce strict CVV validation may currently reject or flag transactions from trusted vault sources due to missing CVV data. This new signal allows developers to differentiate between genuinely incomplete payment data and expected gaps from trusted vault origins, reducing false declines or unnecessary verification friction.
Practical Implications
Adoption of trusted_vault_origin is optional, but implementation requires Shopify to enable the field for a given payment app integration. Developers should not assume the field will appear by default after upgrading API versions.
Teams building or maintaining payment apps on Shopify should review their CVV validation logic now to prepare for conditional handling based on this field. Those interested in enabling this signal should contact Shopify directly, as enablement is not self-service through documentation alone. Monitoring the 2027-01 API version rollout timeline is also recommended for teams planning integration work.