--- title: Migrate to expiring offline access tokens before January... description: Shopify public apps still using non-expiring offline access tokens must migrate to expiring ones before January 1, 2027 to stay listed in the App Store.... canonical: https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Migrate to expiring offline access tokens before January 1, 2027 | daily.dev og:description: Shopify public apps still using non-expiring offline access tokens must migrate to expiring ones before January 1, 2027 to stay listed in the App Store.... og:url: https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk og:image: https://api.daily.dev/og/posts/CKS4y1LLk.png og:image:alt: Migrate to expiring offline access tokens before January 1, 2027 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Migrate to expiring offline access tokens before January 1, 2027 **[Shopify Developer changelog](https://daily.dev/sources/shopifychangelog)** · 2 min read · 0 upvotes · 0 comments ## Summary Shopify public apps still using non-expiring offline access tokens must migrate to expiring ones before January 1, 2027 to stay listed in the App Store. Non-compliant apps get delisted and blocked from new installs on that date, though existing installs can keep making affected API requests until April 1, 2027. Merchants start seeing warnings in Shopify admin on January 15, 2027. On April 1, 2027, affected Admin API requests using non-expiring tokens return HTTP 403. A new client credentials access method lets a backend fetch a fresh short-lived token using a request signed with the app's private key, without a refresh token. Custom apps and merchant-created apps are excluded. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens if my Shopify public app still uses non-expiring offline access tokens after January 1, 2027? The app gets delisted from the Shopify App Store and blocked from new installs on January 1, 2027, though existing installations can keep making affected API requests until April 1, 2027. Merchants see in-admin warnings starting January 15, 2027. On April 1, 2027, affected Admin API requests using non-expiring tokens return HTTP 403. _Teams tracking Shopify API deprecations follow timelines like this one on daily.dev._ ### How can my Shopify app backend get a new access token without a refresh token or merchant interaction? Use client credentials access: send a request signed with your app's private key to obtain a fresh, short-lived access token directly, without needing a merchant to reopen the app or relying on a refresh token. This lets a backend recover access autonomously rather than waiting on user interaction. _Developers migrating Shopify auth flows compare token strategies like this on daily.dev._ ### Does the expiring offline access token requirement apply to custom Shopify apps? No, custom apps and apps created by merchants are excluded from the expiring offline access token requirement. The migration deadline and enforcement schedule apply only to public apps, including those previously covered by the January 1, 2027 deadline and those created on or after April 1, 2026. _Developers scoping Shopify compliance work check requirements like this on daily.dev._ ## Similar posts on daily.dev - [More resilient refreshes for expiring offline access tokens](https://daily.dev/posts/more-resilient-refreshes-for-expiring-offline-access-tokens-sxnqsmpn3) · Shopify Developer changelog · 0 upvotes · 0 comments - [Offline access tokens now support expiry and refresh](https://daily.dev/posts/offline-access-tokens-now-support-expiry-and-refresh-x4a6bm6ix) · Shopify Developer changelog · 0 upvotes · 0 comments - [More resilient token exchanges when migrating tokens without a user session](https://daily.dev/posts/more-resilient-token-exchanges-when-migrating-tokens-without-a-user-session-j1htwj77f) · Shopify Developer changelog · 0 upvotes · 0 comments - [Shopify Lets You Script the Token, Not the App](https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt) · API Evangelist · 0 upvotes · 0 comments - [Your App Has an Expiry Date Too](https://daily.dev/posts/your-app-has-an-expiry-date-too-w6nhyxeyr) · Medium · 0 upvotes · 0 comments --- Tags: [#oauth](https://daily.dev/tags/oauth), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Migrate to expiring offline access tokens before January 1, 2027","url":"https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk"},"datePublished":"2026-10-27T16:48:30.039Z","dateModified":"2026-10-27T16:51:10.582Z","description":"Shopify public apps still using non-expiring offline access tokens must migrate to expiring ones before January 1, 2027 to stay listed in the App Store....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Shopify Developer changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Shopify Developer changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aefcb5d2c1ca4b45b5d2256b9e2a9cc3","url":"https://daily.dev/sources/shopifychangelog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"oauth,shopify","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Shopify Developer changelog","item":"https://daily.dev/sources/shopifychangelog"},{"@type":"ListItem","position":3,"name":"Migrate to expiring offline access tokens before January 1, 2027"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/migrate-to-expiring-offline-access-tokens-before-january-1-2027-cks4y1llk#faq","mainEntity":[{"@type":"Question","name":"What happens if my Shopify public app still uses non-expiring offline access tokens after January 1, 2027?","acceptedAnswer":{"@type":"Answer","text":"The app gets delisted from the Shopify App Store and blocked from new installs on January 1, 2027, though existing installations can keep making affected API requests until April 1, 2027. Merchants see in-admin warnings starting January 15, 2027. On April 1, 2027, affected Admin API requests using non-expiring tokens return HTTP 403. Teams tracking Shopify API deprecations follow timelines like this one on daily.dev."}},{"@type":"Question","name":"How can my Shopify app backend get a new access token without a refresh token or merchant interaction?","acceptedAnswer":{"@type":"Answer","text":"Use client credentials access: send a request signed with your app's private key to obtain a fresh, short-lived access token directly, without needing a merchant to reopen the app or relying on a refresh token. This lets a backend recover access autonomously rather than waiting on user interaction. Developers migrating Shopify auth flows compare token strategies like this on daily.dev."}},{"@type":"Question","name":"Does the expiring offline access token requirement apply to custom Shopify apps?","acceptedAnswer":{"@type":"Answer","text":"No, custom apps and apps created by merchants are excluded from the expiring offline access token requirement. The migration deadline and enforcement schedule apply only to public apps, including those previously covered by the January 1, 2027 deadline and those created on or after April 1, 2026. Developers scoping Shopify compliance work check requirements like this on daily.dev."}}]} ```