Migrating from non expiring to expiring access tokens

Authentication & Access
137

Hi all - today we made a couple of announcements related to expiring access tokens:

  1. We have updated the enforcement timeline for what will happen to public apps that have not migrated by January 1, 2026. The details are in this post but the short version is:

  • January 1, 2027: Non-compliant apps are delisted from the Shopify App Store and blocked from new installs. Existing installations can continue making affected API requests.

  • January 15, 2027: Merchants using non-compliant apps see warnings in Shopify admin about the risk of service interruption and the action they can take.

  • April 1, 2027: Affected Admin API requests using non-expiring offline access tokens return HTTP 403. Workflows that depend on those requests will be interrupted.

  1. We have added support for a new mode of token acquisition, application only access. This mode of token acquisition allows apps to acquire expiring access tokens without merchant interaction after the app is installed in a shop. The access tokens acquired using this grant type will expire after one hour just like the tokens acquired with other grant types.

I know many developers have had questions and concerns about migrating their apps. We have continued improving the access token flows and are monitoring migration progress closely. We’re seeing consistent growth in the number of apps making the transition.

As security threats to apps evolve, protecting merchant and buyer data remains our priority. We are moving forward with this transition while continuing to improve the tools and guidance developers need to migrate successfully.