We use expire tokens, which we receive together with refresh tokens. What to do in a situation where we have a script running on the back and accessing the shopify api when an event occurs. If the expire token is expired, then we will receive a new one using the refresh token, and if the refresh token is expired at this moment, then how do we get a new token? Has the user set up the app and hasn’t logged in for more than 3 months?
Refresh tokens take 90 days to expire.
The endpoint to exchange a new access token with the current refresh token also creates a new refresh token AND access token pair.
I know about 90 days… but if the event worked after 4 months and the back script needs to make a request to the shopify api, then the token is dead, and the refresh token is also dead - will the request fail? This is a decent problem for back-end applications…
You can refresh the token before the 90 days are up so you’ll always have an active token.
I understand correctly that I need to go around all the stores from time to time and update the tokens, especially the reffresh token, when 90 days are about to come… This solution is obvious, but I thought there would be something better.
The merchant doesn’t need to be logged into your app to refresh your access and refresh tokens.
You can refresh them passively with your existing refresh token.
Even a monthly cron job would be safe.
Hmm… creating a cron job just to keep a refresh token alive feels a bit hacky. While a 90-day lack of activity is rare, we’d have to set up this cron job for every app with background jobs just to safeguard the token. Otherwise, if it expires, we can’t fetch a new one unless the merchant manually opens the app. But merchants expect background jobs to work automatically - they won’t be opening the admin panel to check on them…