With the new application only access token — does issuing a new token invalidate other one(s) that were generated less than one hour ago?
No. With application-only access, acquiring a new token does not invalidate previously issued tokens. Each token remains valid until its own expiry unless separately revoked.
would be a good news if at least you listened to the community and gave us more time.
I understand the request for more time and the work this migration requires. Under the enforcement timeline announced today, existing installations can continue making affected Admin API requests through March 31, 2027. However, non-compliant public apps will be delisted from the Shopify App Store and blocked from new installs on January 1, and merchants using them will see warnings beginning January 15. Affected requests using non-expiring offline access tokens will return HTTP 403 beginning April 1.
Throughout this process, we’ve been listening to developers and merchants across the Shopify community - here on the community board, on social media, over email, during AMAs, and in video calls. Those conversations have highlighted both the challenges developers face with migration and the need to strengthen app security.
We’re continuing to improve the token flows, including the application-only access option announced today, while maintaining the expiry requirement. Merchants and buyers rely on Shopify to protect their data, and limiting how long a leaked access token can be used is one part of that responsibility.