Migration email says we have non-expiring offline tokens left, but our app only issues expiring tokens. How do we see which installs are affected?

Shopify App Store
1

Hi everyone,

We got the “Complete your migration to expiring offline access tokens” email. It lists:

  • myCoolApp: 6 tokens to migrate

As far as we can tell, this doesn’t match what our app actually does:

  • Our backend handles OAuth itself (authorization code grant). It sends expiring=1 when it first exchanges the code.
  • Every token we have stored is an expiring token with a refresh token and an expiry time. We removed all code for non-expiring tokens in July 2026.
  • We make no API calls with non-expiring tokens. The API health page where alerts of using non-expiring tokens is gone, so we can’t see if that really is the case.

So the email seems to count tokens our app doesn’t hold or use. Our guess is that these are non-expiring tokens issued a while ago, from installs that came before we switched to expiring tokens. When those shops later got a new expiring token, the old one was apparently never revoked. If that’s right, we can’t migrate these tokens with token exchange, because we no longer have the subject_token to send.

The dashboard doesn’t give us any way to check this per install. As far as we can see, the API health warning only covers the whole app and only reflects recent API usage. It doesn’t tell us whether a given shop still has an active non-expiring token.

Our questions:

  1. What exactly does “tokens to migrate” count? Is it every non-expiring offline token still active for the app, even if it hasn’t been used in months, or only tokens that made API calls recently?
  2. How can we find out which shops or installs these tokens belong to? Is there a page in the Partner or Dev Dashboard, an API, or a support route that lists them?
  3. How do we retire a non-expiring token we no longer have? Uninstalling revokes it, but we don’t want to ask active merchants to reinstall. Will these tokens count against us on January 1, 2027 even though we never use them?
  4. Do dev and staging apps installed on development stores (e.g. through shopify app dev) count? Do they affect the App Store listing of the production app?

We can share app IDs and shop domains privately with Shopify staff if that helps.

Thanks!

2

I don’t have a solution for this but we are in a similar situation. Our email specified:

You have 1559 tokens to migrate. These tokens were used by 919 shops over the past 14 days.

Our app now only issues expiring tokens and we ran a job to convert all non expiring tokens for stores to expiring ones (though obviously only for currently installed stores that are not frozen etc - in other words the ones we had API access to).

Similar to you, our dev dashboard was suggesting that we fix this until a few weeks ago when that message was removed so we assumed we had this one in the bag until this morning when we got that email.

Would also appreciate a steer on how we go about working out the validity of those numbers vs what the dev dashboard is telling us.

3

I’ve also received this email. I migrated all my apps months ago, and there are no warnings on my developer dashboard. Has this email been sent out in error, or has something changed that I’m not aware of?

4

Might be worth following here: Migrating from non expiring to expiring access tokens - #169 by Axel as there’s more folks in a similar spot