Migrate to expiring offline access tokens

Authentication & Access
1

Can anyone help me to migrate from non-expiring token to expiring offline access token in shopify remix template. I could not understand the shopify documentation.

2

Hi @Sujan_Pandey! For apps on the Remix template, the migration is a config change: set the future flag in shopify.server.ts and redeploy.

const shopify = shopifyApp({
  // ...
  future: {
    expiringOfflineAccessTokens: true,
  },
});

The flag only works with the Prisma session storage package, so your Session model needs the refreshToken and refreshTokenExpires fields and you’ll need to run the Prisma migration before you redeploy and reinstall. Once that’s in place, the template handles token refresh for you. The migration guide covers the steps, and it’s worth doing soon since expiring offline tokens become required for all public apps on January 1, 2027, after which non-expiring tokens get authentication errors.

Also check your @shopify/shopify-app-remix version. The flag was added in v4.1.0, so on older 3.x versions it gets silently ignored and the app keeps minting non-expiring tokens. If you’re below that, upgrade first (it’s a major bump, so expect some breaking changes), then set the flag and reinstall.

I’d recommend doing this with a dev/staging app first before trying any production apps with real users. If you hit a 401 or 403 after that, share the details and I can take a further look for you.

3

@Donal-Shopify Hi there,
I followed the steps you provided like

  1. Adding future: { expiringOfflineAccessTokens: true, }, to shopify.server.js

  2. adding refreshToken String? refreshTokenExpires DateTime? to Session model in schema.prisma file and migrating and generating client code.

  3. upgrading older version to @shopify/shopify-app-remix: "^4.1.0".

  4. Ran command shopify app deploy.

  5. Deleted existing session row from database.

  6. Ran shopify app dev

  7. After this when i looked at the session table only accessToken and expires field are populates but not refreshToken and refreshTokenExpires.

  8. How do i confirm the migration is successfull??

4

Hi @Sujan_Pandey - A populated expires on the session row is the signal you want. Non-expiring offline tokens have no expiry, so an expires value about an hour out means the app received an expiring token. A fully migrated session persists all four fields though, so empty refreshToken and refreshTokenExpires suggests the grant or the storage write didn’t complete.

Deleting the session row locally doesn’t cycle the token on Shopify’s side. That happens the next time the merchant opens the app. Run a full reinstall (or at least reopen the app from the admin) so a fresh token grant runs end to end, then check the row again.

If the refresh fields are still empty after that, confirm the Prisma client was regenerated against the migrated schema in the database shopify app dev uses. Also check the dev logs for OAuth or token exchange errors.

If they stay empty, share your @shopify/shopify-app-session-storage-prisma version and what expires shows and I can dig deeper. Best of luck with it!