504 Gateway Timeout when refreshing offline access tokens

Authentication & Access
1

Hello,

I migrated an app to Expiring Offline Access Tokens yesterday and I’m getting 504 timeouts. It’s making me a little nervous.

Has anyone else experienced similar failures?

Example request: 85407875-37f7-4002-8f9e-d31a580cbbe9-1793261201

Thanks

2

Seeing the same thing since about 07:40 UTC today (Oct 29). POST /admin/oauth/access_token is failing across many shops, for both token exchange and refresh requests:

  • About 40% return 504, almost always after about 2 seconds.
  • About 16% get no response within 60 seconds.
  • A few return 503 almost immediately.
  • Successful requests often take 5–30+ seconds.

The day before, the failure rate was under 0.5%.

Example request references (08:06–08:07 UTC):

  • c8244f92-730f-4bf7-a9e9-02fc7d0d3869-1793261220
  • 2521ec82-0b87-410d-b349-b39d13006ed3-1793261208
  • 614eb2b7-7fea-400a-91bc-ee988e3071a0-1793261175
3

Good we still have two month to migrate and we’ve got early testers of this stable solution :wink:

Sarcasm aside, I empathize :cry:

4

Hi all,

Thank you for reporting this, and we’re sorry for the disruption and the worry it caused. I looked into the requests shared (thank you for providing them) to see what the root cause of the errors was.

There was a Shopify-side infrastructure issue that caused a portion of Admin requests to fail with 504 Gateway Timeout errors. Requests to POST /admin/oauth/access_token were among those affected. That includes token exchange, authorization code exchange, and refresh requests. Our team identified and resolved the issue, and error rates have been back to normal since then.

This issue was not specific to authentication, OAuth, or expiring offline access tokens. It affected a range of Admin requests, and token requests happened to be some of the most visible. If you migrated to expiring offline access tokens recently, the timing was a coincidence. Nothing about your migration caused these errors, and no changes are needed on your side.

If any of your token requests failed during that window:

  • Retry with the refresh token you already have. It’s safe to retry a refresh request that failed with a 5xx error.
  • Use retries with exponential backoff for 5xx responses on token requests. This is good practice in general, and it helps your app recover from short disruptions like this one on its own.