Shopify offline access token expires: public app migration by 2027

What changed?

Starting January 1, 2027, Shopify says all public apps must use expiring offline access tokens when calling the Admin API. After that date, public apps still using non-expiring offline tokens can receive authentication errors.

This extends the earlier requirement for newly created public apps to older public apps as well. Shopify's offline access token documentation says expiring offline access tokens use refresh handling and token rotation while still supporting background operations without user interaction.

Who is affected?

Affected apps are public Shopify apps making Admin API requests using non-expiring offline access tokens, including public apps created before April 1, 2026. Shopify lists custom apps and merchant-created apps in the Dev Dashboard or admin as unaffected by this specific change.

What can break?

• Background jobs, scheduled syncs, and webhook-triggered Admin API calls can fail with authentication errors.
• An app can still look installed while server-side Admin API work fails because stored offline tokens no longer satisfy Shopify's requirement.
• Token storage, refresh-token handling, and retry logic may need changes even when merchants do not reinstall the app.
• Apps using older custom auth implementations may need more work than apps using Shopify templates or official libraries.

Smallest safe migration

1. Identify app type. Confirm whether the app is a public app, custom app, or merchant-created app.
2. Find stored offline tokens. Check whether the app still stores non-expiring offline access tokens for Admin API calls.
3. Implement token exchange and refresh handling. Update auth logic so expiring offline tokens can rotate safely.
4. Update token storage. Store token expiry and refresh-token data in a way that background jobs can use reliably.
5. Test background flows. Verify scheduled syncs, webhook consumers, bulk operations, and Admin API calls after token rotation.
6. Ship before January 1, 2027. Do not wait until authentication errors appear in production.

Common searches this page answers

Shopify offline access token expires, Shopify expiring offline access tokens, Shopify public app token migration, Shopify offline access token January 1 2027, and Shopify Admin API authentication errors.

Official sources

• Shopify developer changelog: expiring offline access tokens required
• Shopify docs: offline access tokens

Independent research, not official Shopify support. Verify your app type and OAuth implementation before changing production auth.