Action required: existing public apps must use expiring offline access tokens by January 1, 2027

[PapaZulu]

Hi,

Based on the edge cases that were discovered in another thread about this, I think that the following few changes regarding the expiring access tokens will be very welcome:

1.) Increase the duration of access token from 1 hour to 30 days. Lots of online services has this kind of duration for the token and as pointed by others, if an app is heavily using the Shopify API for backend changes, 1 hour expiration time can be problematic.

2.) If you request a new access token with the refresh token, sometimes, things can go wrong and you don’t receive the response with the new access and refresh token.
To cover this case, it would be good that Shopify API would return the same response (the same access and refresh token) as long as the request is made with the same original refresh token, for a month. This way, if a request fails, the app can just repeat it and it gets the same response again.

Also, as food for thought, some online services have their OAuth system set up in a way that once you request a new access token, the refresh token doesn’t get invalidated. Instead, the refresh token expiration date gets automatically extended by 90 days. This makes the whole OAuth process more resilient to network issues.

It would be great if these changes could be considered.

Thanks

[Ollie_autoBlogger]

I’ve run my first migrations and code changes across my apps to get ahead of the curve.

It’s all simple-ish enough, but god damn, hitting go button on the production migration script is a scary moment.

Fingers crossed everything is migrated and nothing is broken…

Good luck to everyone else!

[Axel]

Same here. I’ve migrated 3 out of my 5 apps. The warnings have disappeared from the Dev Dashboard for those 3 apps, yet the email still reports hundreds of non-migrated tokens for them.

Is this expected? Should we ignore those numbers, or do they actually require any action?