What changed
On August 28, 2026, Shopify changed the retry semantics for expiring offline access-token refreshes. Previously, once an app used a refresh token, that same token could be retried for only about 60 minutes. If Shopify successfully returned a new access/refresh pair but the response was lost—or the app crashed before persisting it—the application could later be left holding an unusable old refresh token and require merchant reauthentication. Shopify now keeps the previously used refresh token valid until the app actually begins using its replacement refresh token. The recovery path is capped at 30 days from the original token's first use and does not extend a refresh token beyond its normal lifetime. Shopify says no migration is required, but applications should still serialize refreshes and persist each returned token pair atomically.
Why it matters
This removes a nasty distributed-systems failure mode from a security migration that is about to affect every public Shopify app using the Admin API. From January 1, 2027, public apps can no longer use non-expiring offline Admin API tokens. That means many long-lived Shopify integrations must rely on refresh-token rotation for the first time. A network interruption or failed database write during rotation should not be able to turn a healthy merchant installation into an authentication outage. The new semantics give apps time to recover automatically while preserving eventual token retirement once the replacement is used.
A lost successful refresh no longer necessarily strands the app
A token-refresh request can succeed at Shopify while the caller never receives or durably stores the returned token pair. Under the older behavior, the caller's old refresh token became unusable after a limited retry window, leaving reauthorization as the recovery path. Shopify now allows that old token to be retried until the replacement token has actually entered use.
The recovery window is deliberately bounded
The old refresh token is not valid indefinitely. Shopify limits recovery to 30 days from the token's first use and does not extend its normal 90-day lifetime. Once the application uses the newly issued replacement refresh token, the previous token is retired. The change therefore adds failure recovery without turning rotation into permanent multi-token validity.
Atomic storage is still the correct implementation
Shopify explicitly says apps should continue to serialize refresh attempts for each shop and persist the returned access-token/refresh-token pair atomically. The new behavior is an emergency recovery path for lost responses and failed writes, not permission to keep multiple active token generations or to ignore concurrency.
The timing matters because expiring tokens become mandatory
Shopify requires all public apps making Admin API requests to use expiring offline access tokens by January 1, 2027. After that date, a public app presenting an old non-expiring offline token receives a 403 and may need merchant reauthentication if it has not completed the migration. The new recovery semantics reduce one operational risk of that much larger mandatory transition.
Custom apps are outside the January migration
Shopify says the January 1 requirement applies to public apps using the Admin API, not custom apps or merchant-created apps. Builders should therefore distinguish the platform-wide token-rotation mechanism from which app classes are actually subject to the 2027 enforcement deadline.