Hi everyone,
Is it true that if I rotate the app secret key, create a new one, and delete the old one, all existing shop access tokens will become invalid?
Something like this seems to be happening with one of my apps. I would appreciate it if someone could confirm how this works.
Thanks!
Hi, if you don’t do step 4 then yes, your access tokens will be invalid and merchants need to visit the app in order to re-authenticate.
Access tokens are tied to the old secret so you need to re-issue them for the new secret before revoking the old one.
Hey @Ajay_Rabari - thankg for reaching out.
Adding a bit more detail to @SeidKorac’s response - generating a new client secret doesn’t invalidate existing access tokens. They stop working only after you revoke the old secret if they’re still tied to it.
Before revoking the old secret, follow Step 4 to replace or refresh the tokens using the method for your token type. This doesn’t always require merchants to reauthorize: Manage your app credentials
Hope this helps!