From 2027 Jan 1 all apps will have to use expiring offline access tokens. While this is a good change for security - It introduces real complexity for apps that heavily rely on the API. We handle over 50 thousand merchants and for most of them we run daily background tasks like image, content and d…

If you have it implemented you can test two ways. First, switch to at least 2026-01. There it will be deprecated and you should receive warnings. Next, switch to 2026-04. In that version they will not work and you’ll get errors. You should have a token exchange that will swap the non-expiring t…

@Liam-Shopify The flow in its current form is an infrastructure nightmare. In real-world production environments, there are hundreds of points of failure. What if the network fails? What if the server crashes? What if the database write fails? As soon as I refresh an access token and receive a ne…

so, we run a carrier service app and serve about 1m requests a day. We’re going to need to refresh the access token every 45min or so for each store installed in order to keep the access token always valid and to keep requests flowing quickly without impacting the already restrictive timeouts assoc…

Hi, We are currently looking into implementing this. As others have mentioned, though, the current approach may introduce some operational challenges, especially for apps running at larger scale. Our main concern is that it could unintentionally make apps on Shopify less resilient in certain edge c…

Also @Liam-Shopify , some clarification please, I noticed in my app dashboard only the newer apps shows this as a requiring a fix by 1st Jan (i.e. ‘public apps’), my older apps do not show this. Can you confirm this is to be implemented for all apps, or just newer apps?

Nothing about how your app makes Admin API requests will change when using expiring tokens vs. non-expiring tokens. Only the request for offline access tokens and the response will change (i.e. the response will include the TTL for the access token and also the refresh token with its TTL). The sim…

@TerenceShopify The app partners’ concern is not how the expiring tokens work. That part is fairly straightforward. Our concern is that if a token expires due to an error, the quality of service provided by our app is degraded. All app partners care about maintaining a reliable service. Our concern…

Hi Terence, are you able to confirm if this must be migrated for ALL apps? or only those shown on the dev dashboard as requiring a fix by 1st Jan?

The token TTL is only 1 hour. That is very short for backend apps running processes that can last hours. It introduces additional complexity and creates more opportunities for failures. If we had 24 hours - It would give us much more breathing space. The Shopify team considered various TTLs for t…

@TerenceShopify Thank you for the great update! The frozen-shop token refresh support is excellent news! Could you please clarify one final detail that is preventing us from migrating to expiring tokens? The API documentation mentions that if a token exchange fails, there is a small retry window.…

Migrating from non expiring to expiring access tokens

Authentication & Access

farid June 15, 2026, 2:16pm 33

@TerenceShopify, I just experienced this error on production after migrating my app to expiring tokens. Can you please take a look?

Topic		Replies	Views
Action required: existing public apps must use expiring offline access tokens by January 1, 2027 Authentication & Access oauth	10	495	June 11, 2026
Dealing with token invalidation when switching to expiring offline tokens Authentication & Access oauth	3	94	May 19, 2026
Offline access tokens now support expiry and refresh Changelog	0	90	December 10, 2025
520 during refresh_token rotation permanently orphans the offline access token Authentication & Access oauth	4	196	June 16, 2026
My app is still in Draft status so I cant use expiring tokens? Dev Platform dev-dashboard	2	106	April 15, 2026

Migrating from non expiring to expiring access tokens

Related topics