What changed
On September 29, 2026, Shopify added lost-response recovery to the direct migration path from legacy non-expiring offline tokens to expiring offline access tokens. If the initial migration succeeds but the response is lost before the app persists the credentials, an eligible retry using the same original non-expiring token and client credentials can return the same access-token and refresh-token pair for up to seven days. Shopify's current migration guide now documents the same behavior. This closes the failure trap that remained after Shopify's August 28 improvement to ordinary refresh-token rotation, where the previously stored refresh token can be retried after a lost refresh response until the replacement begins being used, within that flow's own bounds.
Why it matters
The January 1, 2027 migration deadline still forces existing public apps off non-expiring offline tokens for GraphQL Admin API access, but unattended migration is no longer inherently unsafe to replay after an ambiguous timeout. That matters most for background workers, webhook consumers, app proxies and large installed bases where a merchant may not be present to repair a failed exchange. Builders still need durable token storage and per-store serialization because the migration retry is bounded: recovery can stop after the issued pair is refreshed or a later token acquisition retires it.
Direct legacy-token migration now has a replay window
When an app migrates a stored non-expiring offline token without a user session, Shopify now lets it repeat the same migration request with the original token and client credentials for up to seven days. Eligible retries return the same access-token and refresh-token pair rather than creating a second credential chain.
Recovery can end before seven days
The seven-day window is a maximum, not an unconditional guarantee. Shopify says recovery stops after the app refreshes the issued pair or a later token acquisition for the same store retires it. If the retry then returns invalid_subject_token, the app must obtain a new token through the normal authenticated flow.
Ordinary refresh rotation keeps its separate recovery semantics
Apps already using expiring offline tokens can still recover a lost refresh response by retrying the previously stored refresh token until its replacement is used, subject to Shopify's refresh recovery and token-lifetime rules. The September change brings the one-time legacy migration much closer to that operational safety model without making the two flows identical.
The January 2027 deadline is unchanged
Existing public apps must use expiring offline tokens for GraphQL Admin API requests by January 1, 2027. Shopify's migration guide still supports both normal user-driven acquisition and direct background migration for inactive or background-only installations.
Durable storage still matters
A replay window reduces the cost of a lost HTTP response but does not eliminate credential-state bugs. Apps should serialize token operations per store, atomically persist returned pairs and expiry values, and record migration state so ambiguous failures are retried deliberately rather than treated as fresh migrations.