Hi Shopify team Note: This is specifically about the migration token exchange (expiring=1) idempotency/retry, which differs from existing offline-vs-online token threads (e.g. rate-limit / bulk-operation visibility). I couldn’t find an existing answer for the migration-exchange retry case. Conte…

Hey @masahiko_aruga - thanks for flagging this, and you’re right to separate the one-time migration exchange from the normal refresh flow. I took a closer look on our end, and the migration exchange does not currently have the same one-hour replay behaviour as a refresh_token request. I’m going to…

Thanks so much, @Alan_G — really appreciate you digging into this and separating the migration exchange from the normal refresh flow. Good to know that the migration exchange doesn’t currently share the one-hour replay behaviour of a refresh_token request. Until you’re able to confirm the official …

Whilst the latest changes (1 hour retry window) is a great improvement, i would also echo my concern for an alternative recovery method which does not involve merchant interaction should everything go pear shaped!

@Min_Liu Thanks for chiming in — glad it’s not just us hoping for a merchant-free recovery path. :folded_hands: Quick clarification on one point: when you mention “the latest changes (1 hour retry window),” do you mean the migration exchange now has a 1-hour replay window, or are you referring to …

I’m talking about the refresh flow, we haven’t had any issues with the migration flow and bulk migrated all users. the refresh flow only recently had the 1 hr retry added, previously this was undefined and we found the API failed several times already.

Hey folks - thanks for clarifying, @Min_Liu . Glad to hear the bulk migration went smoothly on your end. I’m still checking the migration-specific retry and recovery behaviour raised by @masahiko_aruga , since that lost-response edge case is still worth confirming. I’ll loop back once I have clearer …

Hey @Min_Liu and @masahiko_aruga - looks like you folks may have seen this, but we’ve recently pushed some changes that should help resolve this: [image] 520 during refresh_token rotation permanently orphans the offline access token Authentication & Access Hi …

Thanks @Alan_G — the refresh-flow resilience change (retrying a refresh with the same refresh_token and getting the same rotated credentials back) is great, and we’ll definitely lean on it for our steady-state refresh handling. :raising_hands: Just to make sure we’re aligned: that change covers the…

Hey @masahiko_aruga - I think you’re right. The change I linked applies to refresh_token rotation and likely doesn’t resolve the one-time migration exchange case. I’m going to follow up specifically on the migration replay and recovery gap. For now, there’s no documented replay guarantee I can poin…

Thanks for confirming, @Alan_G — really appreciate you separating the refresh_token rotation change from the one-time migration exchange, and for following up specifically on the migration replay and recovery gap. :folded_hands: That matches our understanding. We’ll wait for your confirmed guidance…

Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry?

Authentication & Access

Alan_G July 14, 2026, 9:04pm 11

Hey @Min_Liu and @masahiko_aruga - looks like you folks may have seen this, but we’ve recently pushed some changes that should help resolve this:

Please let me know if you’re seeing any other issues though - happy to help

Topic		Replies	Views
Please add recovery parity with refresh tokens Authentication & Access oauth	25	845	October 9, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	129	5086	October 15, 2026
520 during refresh_token rotation permanently orphans the offline access token Authentication & Access oauth	16	1056	July 21, 2026
Action required: existing public apps must use expiring offline access tokens by January 1, 2027 Authentication & Access oauth	33	2045	September 17, 2026
Update: more resilient refresh-token recovery for expiring offline tokens Authentication & Access oauth	3	284	September 4, 2026

Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry?

Related topics