Shopify offline tokens: prepare for the January deadline

Shopify public-app teams have until 1 January 2027 to move to expiring offline access tokens. For merchants, the useful question is whether the apps handling background work have completed that migration and tested renewal. There is no store setting that implements it on an app developer’s behalf.

The deadline was announced on 20 May; it is not a new October requirement. It includes older public apps. Custom apps and merchant-created apps in the Dev Dashboard or Shopify admin are excluded from this mandate, and merchants do not need to reinstall public apps for developers to migrate them.

Move the background jobs, too

Shopify’s current migration guide specifies enforcement on the GraphQL Admin API. Developers should inventory stored non-expiring offline tokens, including those used by jobs that run without a merchant opening the app.

Existing Remix and React Router app templates support the expiringOfflineAccessTokens future flag. Direct token-exchange and authorization-code implementations request expiry with expiring=1. Save the access token, refresh token and both expiry values; subsequent refreshes must also save the replacement refresh token.

A background migration can exchange an eligible stored non-expiring token using the app’s client credentials without a current user session. Once exchanged, that original token no longer authorizes GraphQL Admin API calls. Updating only the interactive login path leaves background workers exposed.

A lost response has a recovery window

Shopify’s 29 September update addresses a specific failure: the exchange succeeds, but the app loses the response before saving its new credentials.

An eligible retry using the same original token and valid client credentials can recover the same access-token and refresh-token pair for up to seven days. Recovery can extend access-token expiry when needed; it does not extend refresh-token expiry. The window ends sooner after a successful refresh or a later token acquisition retires the pair.

Save the recovered pair and expiry values together, then discard the old token. An invalid_subject_token response means recovery is unavailable: obtain credentials through a fresh ID-token exchange or authorization-code grant. The recovery window does not restore the old token’s GraphQL access.

Ask for evidence before the holiday rush

Our recommendation is to schedule a migration rehearsal before peak trading. App teams should demonstrate that an unattended job still works after access-token renewal, that refreshed credentials survive a worker restart, and that a lost exchange response follows the documented recovery path.

Merchants can ask vendors for the migration’s completion date and the background workflows covered by testing. Keep the answer with the app’s operational contact. A January deadline is a reason to plan maintenance now, not evidence that an installed app is already failing.