From 2027 Jan 1 all apps will have to use expiring offline access tokens. While this is a good change for security - It introduces real complexity for apps that heavily rely on the API. We handle over 50 thousand merchants and for most of them we run daily background tasks like image, content and d…

[image] TerenceShopify: All public apps will need to make this change by January 1 2027. If you have a mix of public and custom apps you will see in your Dev Dashboard list of apps that some apps have an API health warning and others do not. Those that do not have the warning may be custom apps,…

I really liked the idea which would solve the problem for app developers: If we perform a token exchange and something goes wrong, we should be able to perform another token exchange using the same access token and refresh token for a period of time, or until the newly issued access token successf…

Dear Shopify Team, I have a suggestion that could be helpful for both app developers and Shopify. It would be great if the Partner Dev Dashboard provided an option to generate a temporary “secret recovery key” with a short expiration period (e.g., 1–2 hours). This key could be used to recreate acc…

Whilst this is a good step forward, those of us with highly automated background processes won’t be able to benefit much from this. Should a fault occur, thousands of merchants will still be impacted for several hours as we have to manually generate and refresh keys. There needs to be a pathway fo…

You are absolutely right. We also have many automated background processes, and I don’t think this aspect has been fully considered by the Shopify team. An offline recovery secret would actually be less of a security risk than a refresh token, since anyone who gains access to the token store would …

@TerenceShopify , I just experienced this error on production after migrating my app to expiring tokens. Can you please take a look? [image] 520 during refresh_token rotation permanently orphans the offline access token Authentication & Access Setup: App using …

[image] elilip: The reason this is important is that Shopify experienced an outage on June 3, and a large number of stores were affected. If token exchanges had occurred during that period, more than 1,100 of our merchants could have been impacted. It is currently unclear how failed token exchan…

We’ve just had a few errors too, luckily the app we are testing on doesn’t have any background processes. We also retry the same request immediately either. @TerenceShopify such errors aren’t acceptable, how do we recover access to these stores without having to ask the merchant to open the app? A…

TTL of one hour? You guys serious?

I see Shopify updated their docs and we have a lot more clarity on what we should do on failure. One-time use and retry behavior: Shopify invalidates the previous refresh token after use. If your app doesn’t receive a response from a refresh request, then retry the same request immediately with th…

Migrating from non expiring to expiring access tokens

Authentication & Access

farid June 15, 2026, 2:16pm 33

@TerenceShopify, I just experienced this error on production after migrating my app to expiring tokens. Can you please take a look?

Topic		Replies	Views
Action required: existing public apps must use expiring offline access tokens by January 1, 2027 Authentication & Access oauth	31	1455	August 14, 2026
520 during refresh_token rotation permanently orphans the offline access token Authentication & Access oauth	16	790	July 21, 2026
Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry? Authentication & Access oauth , access-scopes	10	197	July 16, 2026
Some utility functions that may help after migrating to expiring tokens Authentication & Access oauth	1	61	June 26, 2026
Dealing with token invalidation when switching to expiring offline tokens Authentication & Access oauth	3	125	May 19, 2026

Migrating from non expiring to expiring access tokens

Related topics