Setup: App using expiring offline access tokens, refreshing server-side near expiry with grant_type=refresh_token against POST /admin/oauth/access_token. Issue: for a brief window this endpoint returned HTTP 520 (“error code: 520”) for a shop: [2026-06-15 10:54:07 UTC] POST https://{shop}.myshopif…

Sounds like potentially a timing issue, where the expiration date on the access token isn’t exact, perhaps a bit earlier than what’s reported? How close was the access token to expiring? Seconds, minutes?

Exactly, and I completely agree. This is actually my biggest concern with expiring token migrations. At the beginning of June, I was about to migrate users on one of my apps when Shopify experienced a major API outage. The same thing happened again this morning: I was preparing another migration an…

Not seconds or minutes, it was already long expired. About 6 hours 50 minutes past expiry when the refresh that hit the 520 fired. The timeline from our records: Access token issued 2026-06-15 03:03:42 UTC, ~1h lifetime → expired 04:03:42 UTC. The shop then sat idle (no API calls), so no refresh …

we have had a similar issue, access token expired about a week ago, refresh token still 3 months til expiry, unfortunately wasn’t able to get the error message, but we do retry if any issues and have ended up with stale access and refresh tokens.

I am experiencing the same thing. In my case, I have tried to test regenerating the refresh token, but it returned the same response {"error":"invalid_request","error_description":"This request requires an active refresh_token"}with 401 status code where the refresh token is just generated. Hope to…

Hi folks, Appreciate all the feedback here - we’re working on a solution for this. Will update here when there’s more to share.

@Liam-Shopify We run a public payments app. The expiring offline token changelog is tagged Admin API only and doesn’t appear under the payments-apps-api filter, but our API health warning is triggered by Payments Apps API calls (paymentSessionResolve) made with a non-expiring offline token. Support …

Hi Liam, can you provide details as to what those changes are and the parameters around the retry mechanism? Thanks Min

Amazing Liam is there any action we need to take regarding this?

Is there any architectural change here @Liam-Shopify ?

520 during refresh_token rotation permanently orphans the offline access token

Authentication & Access

Liam-Shopify July 8, 2026, 8:56pm 10

Hi folks,

Update on this issue: We’ve shipped a change today to make token refresh more resilient to transient failures during rotation.

Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry?

Topic		Replies	Views
Update: more resilient refresh-token recovery for expiring offline tokens Authentication & Access oauth	3	284	September 4, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	129	5086	October 15, 2026
Disaster recovery for expiring offline tokens: any path back after a database restore? Authentication & Access oauth	17	1080	September 9, 2026
Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry? Authentication & Access oauth , access-scopes	10	295	July 16, 2026
Confused about subject_token for token exchange vs refresh (expired offline access token) Shopify App Store app-store	5	136	July 23, 2026

520 during refresh_token rotation permanently orphans the offline access token

Related topics