From January 1, 2027, every Shopify public app must use expiring offline access tokens for Admin API requests, according to Shopify's developer changelog; non-expiring offline tokens are rejected after that date, custom and merchant-created apps are exempt, and existing installs can be migrated in code without a reinstall.
Shopify's migration guide says enforcement applies to GraphQL Admin API requests only; the changelog lists the REST Admin API too.
in 76 days · Confirmed by Shopify · Source: Shopify developer changelog ↗ · published · Last checked
Timeline
| Date | Change |
|---|---|
| passed | Expiring offline access tokens required for new public apps as of April 1, 2026 DeprecationBreaking / action requiredPolicy |
| No effective datepublished | More resilient refreshes for expiring offline access tokens API version sunsetBreaking / action required |
| No effective datepublished | More resilient token exchanges when migrating tokens without a user session Announcement |
| in 16 days | Global Catalog REST API stops serving traffic on November 2, 2026 Deprecation |
| in 76 days | Expiring offline access tokens required for all public apps as of January 1, 2027 Breaking / action required |
| in 135 days | Script tags are deprecated and will stop running on March 1, 2027 Breaking / action requiredDeprecation |
See this deadline on the Shopify timeline →
Want Shopify changes by email or Slack? Join the Pro alerts waitlist.
FAQ
- Do merchants have to reinstall my app?
- No. Shopify says the app exchanges existing tokens through code.
- Does this affect custom apps?
- No. Custom apps and merchant-created apps are exempt.
- Does it apply to the REST Admin API?
- Shopify's migration guide says enforcement applies to GraphQL Admin API requests only; the changelog lists the REST Admin API too.
- How long do expiring tokens last?
- Access token 1 hour; refresh token 90 days when issued. Read
expires_infrom the response rather than hard-coding it. - What error will I see if I miss the deadline?
403 Forbiddencontaining "Non-expiring access tokens are no longer accepted for the Admin API".- Can I undo a migration?
- Not per store through the API. Shopify's Node library docs call it irreversible.
Source: Shopify developer changelog. Last checked . Record ID shopify-c6bf4ebc4f · JSON.