Realistically how likely is such a catastrophic situation to occur? Implement the changes carefully and migrate slowly and you should be good.
It may seem small, but before shopify put in the change that returned the same refresh token for 60 minutes, we had a failure every few hours. For the apps we migrated, that equates to hundreds of merchants already access lost.
So we’ve established the endpoint fails, has already failed and likely to fail again.
Now, these failures were just a few minutes, so the previous change mitigates that and i’m happy with that change, but if this were to occur for more than an hour then things turn catastrophic. What are the changes of it going down for more than 1 hour? i would say low, but has shopify had an outage longer than 1 hour? - yes, so will it happen again? - yes.
Now, due to the nature of background tasks, the impact is severe should we lose access and i’m not willing to bet my business nor my merchant’s business on this oversight.
The issue is real, it should be fixed.
I’ve performed this migration for most of my apps 2 months ago, over 100000+ stores (inactive ones counted). This has worked flawlessly on lightweight and background job heavy apps with no issues.
Simple cron job that runs every 15 minutes, grabs tokens 45 days or older (safety margin) with 50 stores max per run and refreshes them (for users that had no activity), otherwise:
For standard requests (not frequent, or not multiple at once):
- expired, needs refresh: query db for token → refresh → save to db first then proceed
- not expired: query db for token → proceed right away
Multiple requests at once (2 in this case lets say):
- query db for token → expired, needs refresh → refresh it → if succeded, save to db then proceed
- query db for token → expired, needs refresh → refresh it → failed, wait 1s and re-read from db then proceed if different, otherwise wait another 1s and reread, and again (3 times max)
This mechanism has performed flawlessly so far over the last 2 months 
It will happen and when it does we’ll have to deal with the situation. But at this point I would just forward anyone complaining to Shopify support directly. Their problem.
and what will happen is Shopify gives a ambiguously worded response which makes it sound like it is wholly your problem and nothing to do with Shopify then recommends a competitor app to them and the merchant ends up leaving.
I don’t think people are confused at all, I think Shopify have dropped the ball on this and what’s making it worse is the silence.
It’s been poorly handled and poorly designed.
Great news 
.
If it breaks, it’s 100%my problem now..
But the silence from Shopify all that time in this thread is not justified.
Agree 100%.
I think the most frustrating thing about this wasn’t the issue itself, it was the lack of communication we got from Shopify.
Hi all, I appreciate the feedback about the refresh process and our communication. We’ve been actively working to ensure that token refreshes work reliably across different types of apps.
This week, we rolled out another update to make the refresh process more resilient and help protect apps when a refresh does not complete successfully. I’ve shared more detail here, and @Luke linked to the related changelog above.
We believe this change will materially improve the reliability of token refreshes. Please continue sharing your feedback and experience. We’re actively monitoring the migration internally and have generally seen positive momentum among the public apps that will be subject to enforcement.
this is great news, thank you!
“The refresh token has a 90-day window, so it will help developers.” This is not true.
The app does not work with refresh tokens; it needs access tokens. We are constantly running webhooks for product create/update as well as order create/update, so we need access tokens almost every minute.
Because of this, the task of constantly updating access tokens will never be finished. Nobody likes tasks that never get finished and keep running moment to moment.
I hope the Shopify team understands what I am trying to say.
@TerenceShopify I have a fresh case from 14 September that the 28 August change should have covered, and did not. The current refresh token, never used, was already dead when we first tried it.
Timeline, all UTC, from our own logs. We fingerprint every refresh token we mint, and every refresh runs under a per-shop Postgres advisory lock with the new pair persisted atomically before the lock releases.
17:34:16 refresh succeeds. Old refresh token in, new access and refresh pair out, stored. Shopify request id 7cf06e12-8bc1-410e-835e-98663f7ab0c5-1789407256.
17:34 to 21:00 nothing touches that shop’s tokens. No refresh, no token exchange, no failed attempt of either. The merchant’s last activity in the app was 17:30. Only webhooks flowed, and none of them needed a token: the access token expired at 18:34, so any Admin call would have forced a refresh, and none was attempted.
21:00:38 first use of the new refresh token. 401 invalid_request, “This request requires an active refresh_token”. Request id 6ff1faa1-ad69-4388-89d1-7de1f4b2cd6c-1789419638.
The app was not uninstalled, the store is live and still sending us webhooks, and the same shop had refreshed fine after gaps of four to seven hours on each of the previous four days. It is a trial merchant who set the app up and rarely opens it, so there is no session token to exchange and the shop stays dead until they happen to come back.
Two questions.
-
What retires a refresh token other than the app using its replacement, an uninstall, or the 90 day lifetime? Something did here and it was not us. Under the 28 August rules the previous token should also have been usable, since the replacement was never used. We keep one generation, so I could not test that.
-
Jon’s question in the parity thread about stores already in a revoked state, where the app still holds the token, is exactly this shop. Is there a remediation path today, or is Partner Support the only route?
This is our second one. The first was 24 June, before the resilience change, same shape: minted, stored, rejected 31 minutes later with nothing in our logs consuming it.
Just want to add a note here that during today’s Shopify outage, there were intermittent refresh failures.
Not to add noise to this already busy thread, but can someone at Shopify please give us an update on whether the January deadline will be moved?
Our team aren’t confident enough in this migration given all the issues being reported. We’re approaching BFCM and the code freeze that comes with it, and our priority is ensuring no disruption across our merchants during their busiest period. For us that has to sit above this deadline.
Then, by the time the holiday surge is over, our team will be on leave with their families until January. That leaves no time before the deadline to implement this after peak, test it properly and have the team around to deal with any issues.
Can someone at Shopify please confirm whether this will be extended to accommodate? We need an answer soon so we can plan around this.
Same here - additionally we’ve screwed all of our deadlines because of the collection release in 2026-07 that was announced with a two weeks notice and received poor communication. We spent nearly two months working on it.
We have better to do for the moment than spending more time implementing code that adds no direct value to the users.
Additionally if a bug occurs leading to a disaster we will have to handle it. We can’t allocate time for that right now.
Same here
Btw, for those who haven’t migrated to polaris web-components we will have to migrate to the new shopify look
Which is another task that we have to dedicate time for
I have to agree here. In addition to the issues that have been reported, we depend on the official shopify_app Ruby library to manage the authentication flow and other crucial things in our apps.
With practically only 3 months to go until the deadline, there are still questions raised in the repo that haven’t been addressed since May. Given the impact of this change, I wish there would be a lot more activity to ensure questions are answered and the docs are in the best possible shape to give developers confidence in the process.
As others have said, there is a busy period coming up soon. We’ve already spent so much time troubleshooting authentication quirks and AppBridge quirks related to that library, and now this.
@TerenceShopify Please give us an update here?
We’ve been holding off until after the sales period too - after seeing all of these issues in this thread. January 1 is one of the worst times on the ecommerce calendar for a critical deadline to be set.