Shopify expiring offline tokens: January 1, 2027 deadline

Shopify just put a hard date on expiring offline access tokens. Every public app that calls the Admin API must migrate by January 1, 2027. Miss it and your app gets pulled from the App Store. Keep ignoring it and, on April 1, 2027, every Admin API call made with an old non-expiring token returns HTTP 403. That is about nine weeks of runway, and the holidays sit in the middle of it.

What actually happened

On October 27, Shopify posted an action-required app security update. The timeline:

• January 1, 2027: public apps that have not migrated are delisted. New merchants can't install them. Existing installs keep working.
• January 15, 2027: merchants running an unmigrated app see a warning in their Shopify admin.
• April 1, 2027: Admin API requests with non-expiring offline tokens fail with 403.

Shopify is explicit that the later dates are a grace period for merchants, not extra time for developers. Custom apps, merchant-created apps and online access tokens are out of scope.

The same post ships new controls:

• Client credentials: if your app loses a refresh token, your backend can mint a new access token signed with your app's private key, without waiting for the merchant to reopen the app.
• IP allowlist: Admin API calls from IPs not on your list are rejected, even with a valid token.
• [network_access] in shopify.app.toml: declare the servers your app talks to so Shopify can flag requests you didn't make.
• shopify app security check: a CLI check Shopify wants run before every release.

Why expiring offline tokens matter for your business

A non-expiring offline token is a permanent key to a merchant's store. If it leaks from a log, a backup or a laptop, it works until someone revokes it by hand. Expiring tokens shrink that window to hours.

The migration is not a find-and-replace. Your app now has to store refresh tokens, refresh before expiry, handle races when two workers refresh at once, and recover when a refresh fails. Background jobs (inventory syncs, order exports, nightly reports) are where this breaks, because nobody is watching them at 3 a.m.

If you are a merchant, not a developer: ask every public app vendor you rely on whether they have migrated. A delisted app still runs today. On April 1 it stops talking to your store.

Sources: Shopify.dev: App security updates, October 2026, Shopify developer changelog.