Shopify requires public apps to use expiring offline access tokens for Admin API requests. Non-expiring tokens get your app delisted on 1 January 2027 and hard-failed on 1 April 2027. We inventory your tokens, change the code, migrate dormant installs and hand over a cutover note - in about one week, at a fixed price.
Sources: official Shopify migrate guide · Shopify developer changelog, 5 Nov 2026
Non-expiring offline Admin API tokens never rotate, so one leaked token is a permanent credential. Moving to expiring tokens is not a config toggle: it changes what your token exchange requests, what you store (access token, refresh token, expires_in and refresh_token_expires_in), when you refresh, and how you handle stores whose merchants never open your app.
Most public apps have three loose ends at once: old auth code still requesting non-expiring tokens, a token store with no refresh bookkeeping, and dormant installs that only a background migration can reach. Miss any one of them and on 1 April 2027 your app starts returning 403s to merchants mid-session.
Who this applies to: public apps calling the GraphQL or REST Admin API. It does not apply to custom apps, apps created by merchants, or Payments Apps API requests. Newly scaffolded apps already request expiring tokens.
Shopify exposes this directly in your Partner Dev Dashboard:
Shopify's Token Expiry FAQ answers the common questions. If you would rather hand the whole thing to someone who has done it, that is what the two tiers below are for.
List every store still on a non-expiring offline token, from Dev Dashboard log filters plus your own token store - so nothing is migrated twice or missed.
Enable expiring tokens the way your app is built: the expiringOfflineAccessTokens template flag, or expiring=1 on token exchange / authorization-code grant. Store refresh tokens and both expiry values; refresh before access expiry.
Background-only installs (webhook consumers, app proxies, Flow actions) never trigger a re-auth. We run Shopify's direct migration flow for them, so no merchant action is needed.
A written note for your engineering and support teams: what changed, what was migrated, how refresh is handled now, and what to do if a 403 ever appears after 1 April 2027.
We never rewrite your whole auth stack - only the token acquisition, storage and refresh path. IP allowlist work is a separate service (see below).
Fixed scope agreed in writing before we start. If your app turns out to be already fully on expiring tokens, the audit stops there and you pay nothing for the rest.
IP allowlist: every public Admin API app also needs an IP allowlist - bulk operations stopped working without one on 12 November 2026, and the app-wide deadline is 20 November 2026 with the same 1 April 2027 enforcement. Different job, same Partner Dashboard: IP Allowlist Rescue for public apps.
We are a custom app, not a public app. Are we affected?
No. The timeline does not apply to custom apps, apps created by merchants, or Payments Apps API requests. It only applies to public apps calling the GraphQL or REST Admin API.
Our app was scaffolded recently. Do we need this?
Newly scaffolded apps already request expiring tokens through the expiringOfflineAccessTokens flag. Run the free Dev Dashboard log check above - if no rows show Offline, non-expiring, you are done.
What actually happens on 1 April 2027 if we do nothing?
Shopify rejects any GraphQL or REST Admin API request presenting a non-expiring offline token with a 403, and merchants lose access to your app until they re-authenticate. Existing installs only keep working until that date.
Why do dormant installs need special handling?
An install only migrates when your app acquires an expiring token - normally triggered by a merchant opening the app. Background-only installs (webhooks, app proxies, Flow actions) never do that, so Shopify provides a direct migration flow that uses the stored non-expiring token without a user session. We run that flow for every dormant store.
Do you need access to merchant data?
No. This is your Partner Dashboard, your code and your token store. We work with your permission inside your infrastructure; merchant data stays in your systems.
How do payments work?
Fixed scope, fixed price, invoiced. We agree the scope in writing first; payment terms are on the invoice.
Is Sipiteno affiliated with Shopify?
No. We are an independent engineering consultancy. Everything here follows Shopify's public developer documentation, linked above.