More resilient token exchanges when migrating tokens without a user session
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on September 29, 2026.
This Shopify update is categorized as API, Update, GraphQL Admin API, Admin REST API.
What changed
When you migrate an existing non-expiring offline token to an expiring offline access token without a user session, an eligible retry using the same original token and client credentials returns the same access-token and refresh-token pair as the initial exchange. On an eligible retry: Shopify returns the same access token and refresh token. Shopify extends the access token’s expiry when needed. Shopify doesn’t extend the refresh token’s expiry. Recovery for a particular store and app ends when any of the following is true: Seven days have passed since the initial exchange for that original token.
Who is affected
This change affects apps that migrate existing non-expiring offline tokens without a user session, as described in the guide on migrating existing tokens without a user session.
What action may be needed
When you don’t receive or persist the migration response: Repeat the same migration request with the original non-expiring token and valid client credentials, within seven days of the initial exchange. Persist the returned access token, refresh token, and expiry values together. Discard the original non-expiring token so your app doesn’t attempt to use it again.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →