From 2027 Jan 1 all apps will have to use expiring offline access tokens. While this is a good change for security - It introduces real complexity for apps that heavily rely on the API. We handle over 50 thousand merchants and for most of them we run daily background tasks like image, content and d…

You are absolutely right. We also have many automated background processes, and I don’t think this aspect has been fully considered by the Shopify team. An offline recovery secret would actually be less of a security risk than a refresh token, since anyone who gains access to the token store would …

@TerenceShopify , I just experienced this error on production after migrating my app to expiring tokens. Can you please take a look? [image] 520 during refresh_token rotation permanently orphans the offline access token Authentication & Access Setup: App using …

[image] elilip: The reason this is important is that Shopify experienced an outage on June 3, and a large number of stores were affected. If token exchanges had occurred during that period, more than 1,100 of our merchants could have been impacted. It is currently unclear how failed token exchan…

We’ve just had a few errors too, luckily the app we are testing on doesn’t have any background processes. We also retry the same request immediately either. @TerenceShopify such errors aren’t acceptable, how do we recover access to these stores without having to ask the merchant to open the app? A…

TTL of one hour? You guys serious?

I see Shopify updated their docs and we have a lot more clarity on what we should do on failure. One-time use and retry behavior: Shopify invalidates the previous refresh token after use. If your app doesn’t receive a response from a refresh request, then retry the same request immediately with th…

@TerenceShopify I’ve already migrated all my apps without backend processes to expiring tokens, however our main app, which is heavy on backend API calls i have not migrated yet as i’m currently testing the reliability of this process. I’ve already encountered unrecoverable errors and as such, the…

Adding a production data point that lines up with what @Min_Liu and @farid reported. We launched on expiring offline tokens. Setup is the textbook one: refresh under a per-shop lock, store the new access + refresh token in the same transaction, single-flight so we never use a refresh token concurr…

I encourage Shopify to consider delaying this until April 1st, 2027 instead of January 1st, 2027, so that we can all get through Q4. It’s good to hear that old access tokens aren’t immediately expired when a new one is minted via a refresh token. For large, distributed systems, assuming most backgr…

Migrating from non expiring to expiring access tokens

Authentication & Access

Liam-Shopify June 25, 2026, 10:17am 40

Hi @Min_Liu & @Luke

We’re investigating the best methods for handling outages - appreciate the suggestions and will update here as soon as possible.

Topic		Replies	Views
Action required: existing public apps must use expiring offline access tokens by January 1, 2027 Authentication & Access oauth	23	879	July 14, 2026
520 during refresh_token rotation permanently orphans the offline access token Authentication & Access oauth	15	598	July 13, 2026
Is the offline-token migration exchange (non-expiring → expiring, expiring=1) idempotent and safe to retry? Authentication & Access oauth , access-scopes	6	95	July 13, 2026
Some utility functions that may help after migrating to expiring tokens Authentication & Access oauth	1	42	June 26, 2026
Dealing with token invalidation when switching to expiring offline tokens Authentication & Access oauth	3	103	May 19, 2026

Migrating from non expiring to expiring access tokens

Related topics