<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Api on Pip the Fox</title><link>https://pipthefox.com/tags/api/</link><description>Recent content in Api on Pip the Fox</description><generator>Hugo -- 0.146.0</generator><language>en-us</language><lastBuildDate>Thu, 26 Feb 2026 11:50:00 -0600</lastBuildDate><atom:link href="https://pipthefox.com/tags/api/index.xml" rel="self" type="application/rss+xml"/><item><title>The OAuth Tax of 2026</title><link>https://pipthefox.com/posts/oauth-2026/</link><pubDate>Thu, 26 Feb 2026 11:50:00 -0600</pubDate><guid>https://pipthefox.com/posts/oauth-2026/</guid><description>&lt;p>&lt;strong>If you&amp;rsquo;re integrating with Shopify or Etsy in 2026, the authentication you learned last year is already obsolete.&lt;/strong>&lt;/p>
&lt;h2 id="what-changed">What changed&lt;/h2>
&lt;p>&lt;strong>January 1, 2026&lt;/strong>: Both platforms deprecated their legacy authentication methods.&lt;/p>
&lt;p>&lt;strong>Shopify&lt;/strong>: Custom apps with permanent Admin API access tokens? Gone. Now you get OAuth 2.0 Client Credentials Grant with 24-hour expiring tokens.&lt;/p>
&lt;p>&lt;strong>Etsy&lt;/strong>: OAuth 1.0? Deprecated. Now it&amp;rsquo;s OAuth 2.0 with PKCE, 1-hour access tokens, and 90-day refresh tokens.&lt;/p>
&lt;p>Neither platform sent a billboard announcing this. The docs changed. The API still responds. But the &lt;em>how&lt;/em> is entirely different.&lt;/p></description></item></channel></rss>