November 2, 2026 · Muhammad Umar · More by Muhammad Umar
Shopify's New trusted_vault_origin CVV Signal
trusted_vault_origin lets payment apps skip CVV checks on vaulted cards, but three separate gates decide whether you ever see the field at all.
What the field actually says
On October 30, 2026, Shopify's Payments Apps API 2027-01 release candidate added payment_method.data.trusted_vault_origin, an optional Boolean, to credit card payment and verification requests. It appears in both the encrypted-card and payment_instrument payload formats, sitting in payment_method.data — outside the encrypted card details or the payment_instrument object itself.
The field has exactly two meanings. true means don't reject the payment or verification for a missing CVV alone — a CVV may still be present, but its absence isn't grounds for rejection on its own. false, or the field being absent entirely, means keep your existing CVV rules for that flow, including any flow that already accepts payments without a CVV. Shopify is explicit that the field doesn't identify which vault the card came from, and apps shouldn't try to infer it from vault_status or transaction_reason — it's a single trust signal, not a vault identifier.
Three gates, not one
This is the detail worth building process around: upgrading your extension's API version does not turn this feature on by itself. Three separate conditions all have to hold before Shopify ever sends the field. First, your payments app extension's api_version must be 2027-01 or later. Second, Shopify must have specifically enabled the field for your app — this isn't self-service. Third, Shopify has to actually have a value to send for that request. Miss any one of the three and Shopify omits the field entirely, the same as on any earlier API version.
Practically, that means a team can bump api_version to 2027-01, redeploy, and still never see trusted_vault_origin in a live request, because Shopify hasn't enabled it for that app yet. Shopify's own guidance reflects that staging reality: use the 2027-01 release candidate for testing, but keep production apps on a supported stable version. No immediate production migration is required.
What it doesn't touch
Adopting the flag doesn't change anything else in a payments app's obligations. Fraud checks, 3-D Secure authentication, and validation of any CVV that is actually present still apply regardless of how trusted_vault_origin reads. The field narrows one specific rejection path — missing CVV alone — for cards Shopify has already decided came from a trusted vault; it isn't a blanket relaxation of verification, and it isn't something a merchant or app developer can switch on from their own side.
For teams testing against the release candidate, Shopify's own checklist is worth following directly: exercise true, false, and an absent field, with and without a CVV present, across every payload format the app supports, for both payment and verification requests.