Shopify Extends Grace Period for Expiring Offline Access Token Refreshes

What Changed

Shopify has updated how expiring offline access tokens handle refresh operations. Under the new behavior, when an app refreshes an expiring offline access token, the previously used refresh token remains valid until the app begins using its replacement. This differs from the prior system, where a used refresh token stayed valid for a fixed 60-minute retry window regardless of whether the app successfully received or stored the new token pair.

The change addresses a specific failure scenario: if an app’s refresh request succeeds on Shopify’s end but the response is lost in transit, dropped due to a network error, or fails to persist correctly in the app’s database, the app previously had a limited window to recover before losing access entirely. Now, the old refresh token stays active until the app actually adopts the new one, removing the time-boxed constraint.

No migration steps are required. This is a backend behavior change that applies automatically to existing and new offline token refresh flows.

Why This Matters

Token refresh failures are a common source of authentication errors in production Shopify apps, particularly for apps handling high transaction volumes or operating in environments with intermittent connectivity or database write failures. A lost or unsaved refresh response could previously force an app into a broken auth state, requiring re-authorization or manual intervention. This update reduces that failure surface by giving apps more flexibility to recover using the last-known-good refresh token.

Practical Implications

Developers should continue storing every refreshed access token and refresh token pair atomically, ensuring both values are written to persistent storage in a single transaction. Apps that currently implement retry logic around token refresh calls should verify that logic still functions correctly under the new behavior, since the retry window is no longer time-limited but instead tied to adoption of the new token.

Read the full announcement →