When will shopify-app-express support expiring offline access tokens?

Zwei_Black · July 13, 2026, 3:39am

I have already updated the frameworks used by Remix and React Router, but I noticed that shopify-app-express does not yet officially support expiring offline access tokens. Many users have raised this issue on GitHub, and some have even submitted pull requests.

github.com/Shopify/shopify-app-js

shopify-app-express does not pass expiring: true during OAuth callback, causing 403 on all public apps created after April 1, 2026

opened 01:00PM - 26 May 26 UTC

ashishnitw

devtools-gardener

## Overview **Package**: @shopify/shopify-app-express@7.0.0 **Related package**…: @shopify/shopify-api@13.0.0 **Problem** As of April 1, 2026, Shopify requires expiring offline tokens for all new public apps (changelog: https://shopify.dev/changelog/expiring-offline-access-tokens-required-for-new-public-apps-as-of-april-1-2026). However, `shopify-app-express` never passes `expiring: true` when calling `api.auth.callback()` in `auth-callback.ts`: // packages/apps/shopify-app-express/src/auth/auth-callback.ts const callbackResponse = await api.auth.callback({ rawRequest: req, rawResponse: res, // expiring is never passed — defaults to false }); `shopify-api@13` supports this via the `expiring` parameter (added in December 2025), but `shopify-app-express` never uses it, so Shopify always returns a non-expiring `shpat_` token. Any API call made with that token on a new public app returns: { "networkStatusCode": 403, "message": "GraphQL Client: Forbidden" } **Expected behaviour** `shopify-app-express` should pass `expiring: true` by default for offline token OAuth flows, since Shopify now mandates expiring tokens for all new public apps. Ideally this should also be configurable (e.g. a `useExpiringTokens` option in `shopifyApp()` config) for apps that need to opt out or migrate gradually. **Suggested fix** In `auth-callback.ts`, change: const callbackResponse = await api.auth.callback({ rawRequest: req, rawResponse: res, }); to: const callbackResponse = await api.auth.callback({ rawRequest: req, rawResponse: res, expiring: true, }); **Workaround** Skip `shopify.auth.callback()` and call `shopify.api.auth.callback({ expiring: true })` directly in your own route handler, storing the session and registering webhooks manually.

github.com/Shopify/shopify-app-js

Add support for expiring offline access tokens to shopify-app-express

opened 12:39AM - 08 May 26 UTC

dansundy

devtools-gardener

## Overview It currently doesn't seem possible to request expiring offline acce…ss tokens when using the `@shopify/shopify-app-express`. As of April 1 this is now required, so not being able to request expiring offline tokens is problematic for any new apps using this library. Could we either have the future flag: ``` shopifyApp({ api: { ... }, future: { expiringOfflineAccessTokens: true } }); ``` Or even just flag on the existing auth object? ``` shopifyApp({ api: { ... }, auth: { path: '/api/auth', callbackPath: '/api/auth/callback' expiring: true } }); ```

github.com/Shopify/shopify-app-js

Complete your migration to expiring offline access tokens

opened 12:58AM - 09 Jul 26 UTC

ngothoai

devtools-gardener

I'm using the `@shopify/shopify-app-express` library to build my Shopify app. R…ecently, I received an email from Shopify asking me to **"Complete your migration to expiring offline access tokens."** When I checked my app, I noticed that the Express library doesn't support the following configuration that exists in the Remix package: ```ts future: { expiringOfflineAccessTokens: true, }, ``` I'm currently using: ```json "@shopify/shopify-app-express": "^7.0.0" ``` I contacted Shopify Support regarding the expiring offline access token requirement. They sent me the migration documentation, which is essentially a workaround (or patch) rather than a built-in solution. I also submitted a feature request asking Shopify to update the Express library so developers can simply enable this feature by adding an option, just like they can with the Remix package. However, I just checked the latest version of `@shopify/shopify-app-express` (v7.0.1), and this functionality is still missing. From my understanding, **expiring offline access tokens are now a mandatory Shopify requirement.** If that's the case, why hasn't Shopify updated its own official Express package to support this feature? Instead, developers are expected to manually patch their apps using migration guides. Honestly, this doesn't make much sense. If a migration is required, this is not a smart or developer-friendly approach. I sincerely hope the maintainers of the Shopify package see this issue and add native support for expiring offline access tokens as soon as possible. Thank you.

It has been over two months since the earliest issue was raised, but there seems to have been no progress.

Although it is possible to use a forked version in the meantime, I would like to know when official support will be added to shopify-app-express to ensure smoother future upgrades.

Should I migrate to React Router? However, this application has been running for over three years and contains a large number of pages and non-React components, making migration seem neither easy nor practical. I hope the official team can provide support as soon as possible.

Alan_G · July 14, 2026, 2:45pm

Hey @Zwei_Black -

I checked into this, and you’re right that @shopify/shopify-app-express doesn’t appear to currently provide complete built-in support for expiring offline access tokens.

Since your app has been running for over three years, the April 1, 2026 requirement doesn’t apply to it. Existing public apps need to complete the migration by January 1, 2027, so I wouldn’t recommend moving the entire app to React Router solely because of this.

One important detail is that adding expiring: true to the callback alone isn’t a complete migration. The app also needs to store the refresh token and expiry metadata, refresh access tokens when needed, and exchange existing non-expiring tokens.

That said, I’ll flag this internally for you for sure, since I realize it’s not ideal. I’ll loop back here if I can confirm the intended fix or release path.

Dmitri_Pavlutin · July 14, 2026, 4:48pm

+1 to add the support of expiring offline tokens to @shopify/shopify-app-express. We have an app which still uses express and this is necessary for us to migrate to expiring tokens.

Zwei_Black · July 28, 2026, 4:50am

Thank you for your response. We hope to have the version updated a few months before the deadline, so that we still have time for testing and deployment. Otherwise, we may have to apply our own patches or extract the relevant logic ourselves, which could potentially impact future framework upgrades.

Alan_G · July 29, 2026, 2:58pm

Hey folks - a bit of an update here.

We are looking into enabling this in a near future release. I can’t say exactly when we’ll have this rolled out, but I’ll update this thread once we have more info/when the update is live.

Thanks for your patience here

Topic		Replies	Views
Please update expires option like React App Router, Dev Platform dev-dashboard , cli , app-deployment	2	75	June 13, 2026
Action required: existing public apps must use expiring offline access tokens by January 1, 2027 Authentication & Access oauth	26	1296	August 3, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	55	2351	August 4, 2026
State of shopify-app-express Shopify CLI and Libraries education	16	880	August 25, 2025
My app is still in Draft status so I cant use expiring tokens? Dev Platform dev-dashboard	2	140	April 15, 2026

When will shopify-app-express support expiring offline access tokens?

Related topics