ST-2026-019 · Authentication & identity
Shopify requires expiring offline access tokens for every public app
Shopify is extending its expiring-offline-token requirement from newly created public apps to all public apps, with non-expiring Admin API credentials returning authentication errors from 1 January 2027.
Previous state
Existing public apps created before 1 April 2026 could continue using non-expiring offline access tokens for Admin API background operations.
Current state
All public apps must use 60-minute expiring offline access tokens and refresh tokens; non-expiring offline credentials receive authentication errors after the enforcement date.
Affected users
Who needs to care
Public apps making REST or GraphQL Admin API requests, including apps created before 1 April 2026. Custom apps and merchant-created apps are outside the stated requirement.
Required response
What to do
Implement refresh-token storage and rotation, exchange each existing installation’s non-expiring credential without requiring merchant reinstall, update persistent secret state atomically, refresh proactively and on authentication failure, and monitor API Health for migration status.
Evidence boundary
What the source does not prove
The requirement is specific to public-app Admin API offline access tokens. Shopify explicitly excludes custom apps and merchant-created apps, and states that merchants do not need to reinstall. It does not apply broadly to every Shopify API or every access-token type.
Lifecycle history
Dated event sequence
- Expiring tokens introduced
Shopify added optional 60-minute offline tokens with refresh tokens while existing perpetual tokens continued temporarily.
- New-public-app requirement
Public apps created from this date had to use expiring offline tokens.
- Requirement expanded
Shopify announced that the same model would apply to all public apps.
- All-public-app enforcement
Admin API calls using non-expiring public-app offline tokens begin returning authentication errors.
Evidence ledger
First-party sources
- 01Shopify Developer Changelog — Offline access tokens now support expiry and refresh
Official capability introduction · 2025-12-10
Open official source ↗ - 02Shopify Developer Changelog — Expiring offline access tokens required for new public apps as of April 1, 2026
Official first-stage enforcement notice · 2026-03-20
Open official source ↗ - 03Shopify Developer Changelog — Expiring offline access tokens required for all public apps as of January 1, 2027
Official all-public-app enforcement notice · 2026-05-20
Open official source ↗