Refresh token returned with an expiry far shorter than the documented 90 days

Authentication & Access
1

Setup: App migrated from non-expiring offline access tokens to expiring offline access tokens, following the migration guide. Stack: Ruby on Rails, using shopify_app 23.0.2 and shopify_api 16.2.0.

Issue: For multiple shops, after calling grant_type=refresh_token against POST /admin/oauth/access_token, the refresh_token returned in the response appears to have an expiry far shorter than the documented 90-day lifetime.

Timestamps (JST) — example from one of the affected shops:

Refresh call made at (approx.):          2026-07-02 12:00:12 (JST)
New access_token expires_at:             2026-07-02 13:00:11.553141 (JST)
New refresh_token expires_at:            2026-07-02 12:00:13.553145 (JST)

The new refresh_token expires about 1 hour before the new access_token — essentially only ~1 second after the refresh call itself — instead of ~90 days later. We’ve confirmed this pattern across several different shops, not an isolated case.

We reviewed our shopify_app gem integration and confirmed it simply persists whatever refresh_token value comes back in Shopify’s response, with no client-side recalculation of the expiry. Given that, we believe this is likely an issue on Shopify’s side (i.e., the value actually returned by the token endpoint for these refreshes), rather than a bug in our storage logic.

Could someone from the Shopify team please look into this?

2

That’s concerning - did you log the request IDs from the response?

That would help speed up their investigation so they can review the exact request logs.

3

Unfortunately, no request ID is available, since the shopify_app and shopify_api gems maintained by Shopify don’t log anything during token refresh.

4

@masaki_nagaoka are you still seeing this issue? Can you share the actual response (not including the tokens themselves) that you’re seeing?

5

Yes, the issue is still occurring. Most recently, it happened around 2026-07-15 05:56:16.

Since we perform access token refresh through the Ruby libraries created by Shopify, shopify_api and shopify_app, we are unable to obtain the full response. Would the following information be sufficient instead?

  • access_token_expired_at
  • refresh_token_expired_at
  • shopify_session_id

The above are the pieces of information provided by the shopify_api library.

Also, regarding obtaining the request-id included in the response headers, the shopify_api library does not currently support this, so we have opened a GitHub issue requesting a way to retrieve it: Provide a way to access the request-id when refreshing an access token · Issue #1453 · Shopify/shopify-api-ruby · GitHub

6

Regarding “Refresh token returned with an expiry far shorter than the documented 90 days”:

This issue has been resolved.
Jon from Shopify Developer Support confirmed on 7/31 that the fix has been completed.
On our end, we have verified that the issue has not recurred since 7/26.
Thank you to the Shopify support team and fellow developers for your help.