Shopify sets a January 2027 deadline to kill non-expiring tokens
Public apps still using non-expiring offline access tokens on the Admin API get a hard cutover date, with a second deadline in April that starts returning 403s.
Shopify published a developer changelog entry on 27 October requiring every public app to use expiring offline access tokens for Admin API calls, with enforcement starting 1 January 2027.
From that date, new installs and app-listing status depend on using expiring tokens: a non-compliant app is delisted from the Shopify App Store and blocked from new installs. Existing installations get a grace period, but on 1 April 2027 the Admin API starts returning HTTP 403 for requests still authenticated with a non-expiring token. Custom apps and merchant-built apps are excluded. Shopify’s stated reason is the blast radius of a leak: a non-expiring token is valid forever if it escapes, while an expiring one closes that window in 60 minutes and rotates automatically.
Why it matters: if you maintain a public Shopify app built before this policy existed, you have a little over two months before the store listing is at risk, and five before API calls start failing outright. Shopify’s migration guide handles the token exchange in code, merchants don’t need to reinstall anything.
The caveat: this only applies to public apps distributed through the App Store. Custom and merchant-built apps keep using non-expiring tokens for now.