Expiring offline access tokens required for all public apps as of January 1, 2027
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on May 20, 2026.
This Shopify update is categorized as Action Required, API, Breaking API Change, Admin GraphQL API, Admin REST API.
What changed
We're changing how public apps handle offline access tokens to enhance merchant data protection. Starting January 1, 2027, all public apps must use expiring offline access tokens when calling the Admin API. After that date, public apps still using non-expiring tokens will receive authentication errors. This extends the April 1, 2026 change, which applied only to newly created public apps, to all public apps, including those created before April 1, 2026. What apps are affected Public apps making Admin API requests using non-expiring offline access tokens, including apps created before April 1, 2026 What apps are unaffected Custom apps Apps created by merchants either in the Dev Dashboard or in the admin Why we're making this change Non-expiring tokens, if leaked, remain valid indefinitely.
Who is affected
Apps using the affected Shopify GraphQL API surface should review this change.
What action may be needed
Existing public apps: Migrate from non-expiring to expiring offline access tokens. Merchants don't need to reinstall, as your app exchanges existing tokens through code. Follow the migration guide for the step-by-step path. If you use Shopify's app templates and official API libraries, refresh handling is already implemented; you only need to handle the token exchange and storage updates.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →