October 24, 2026 · Muhammad Rehan · More by Muhammad Rehan
Shopify's Expiring Token Migration Gets Two Recovery Windows
Shopify's January 2027 offline-token deadline stays fixed, but two 2026 updates added 30-day and 7-day recovery windows for lost responses.
Public Shopify apps calling the GraphQL Admin API with non-expiring offline access tokens have a hard deadline: January 1, 2027. After that date, Shopify rejects any GraphQL Admin API request that presents a non-expiring token, and the merchant loses access to the app until they re-authenticate. The enforcement applies only to public apps calling the GraphQL Admin API — custom apps and merchant-created apps are exempt.
Over the second half of 2026, Shopify shipped two changes to the token lifecycle underneath that deadline. Neither moves the deadline or extends token lifetimes. Both are narrow fixes for the same failure mode: a network blip, a worker crash, or a storage failure that happens after Shopify processes a request but before the integration persists the result.
A 30-Day Grace Period on Refresh
An expiring offline access token lasts one hour. Its refresh token lasts 90 days when issued, though using it to refresh can shorten that window. Before August 28, 2026, if an app used a refresh token and then lost or failed to save the new access/refresh pair, it had 60 minutes to retry with the old refresh token before that recovery path closed.
As of August 28, 2026, that window is longer: the previous refresh token stays usable until the app starts using its replacement, or 30 days after the previous token's first use, or its original 90-day expiry — whichever comes first. This doesn't extend any token past its normal lifetime; it only gives a stalled integration more time to recover from a lost refresh response.
A 7-Day Retry Window on Migration
The second change, shipped September 29, 2026, covers the one-time exchange that migrates an existing non-expiring token to an expiring pair without a user session — the path background jobs, webhook consumers, and app proxy backends use. If the first migration response is lost, the app can retry the same exchange with the same original non-expiring token and client credentials for up to seven days. An eligible retry returns the same access-token and refresh-token pair; Shopify extends the access token's expiry if needed but never the refresh token's. Recovery ends after seven days, after the first successful refresh of the new pair, or after any later token acquisition for that store.
What Integrations Still Have to Implement
Neither change substitutes for correct engineering. An integration still needs to persist every access-and-refresh-token pair atomically, serialize refresh operations per shop so two processes don't race to use the same refresh token, and always refresh with the newest token it has stored. A 401 with invalid_request on refresh, or a 400 with invalid_subject_token on migration, means the recovery window has closed — the correct response is to re-authenticate through ID-token exchange or the authorization code grant, not to keep retrying. For engineering teams maintaining ERP, PIM, 3PL, or CRM connectors against Shopify, that distinction — recovery window versus terminal failure — is what determines whether the January 2027 deadline is a quiet migration or an outage.