---
title: >-
  Migrate to expiring offline access tokens before January 1, 2027 - Shopify
  developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/posts/migrate-to-expiring-offline-access-tokens-before-january-2027
  md: >-
    https://shopify.dev/changelog/posts/migrate-to-expiring-offline-access-tokens-before-january-2027.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: Platform
    handle: platform
  secondaryTag:
    displayName: Update
    handle: update
  indicatesActionRequired: true
  createdAt: '2026-10-23T11:03:19-04:00'
  postedAt: '2026-10-27T12:40:00-04:00'
  updatedAt: '2026-10-27T12:45:03-04:00'
  effectiveAt: '2026-10-24T12:00:00-04:00'
---

October 27, 2026

# Migrate to expiring offline access tokens before January 1, 2027

DateOctober 27, 2026

FlagsUpdate[Action required](https://shopify.dev/changelog?action_required=true)

SurfacesPlatform

Public apps still using non-expiring offline access tokens must migrate to use [expiring offline access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens#offline-access-tokens) before January 1, 2027 to remain listed in the Shopify App Store and continue accepting new installs.

New [client credentials access](https://shopify.dev/docs/apps/build/authentication-authorization/application-only-access-tokens) helps your backend recover access without waiting for a merchant to reopen your app. Using a request signed with your app's private key, your backend can obtain a fresh, short-lived access token without a refresh token.

The enforcement timeline has been updated with incremental penalties for non-compliant apps:

* **January 1, 2027:** Non-compliant apps are delisted from the Shopify App Store and blocked from new installs. Existing installations can continue making affected API requests until April 1.
* **January 15, 2027:** Merchants using non-compliant apps see warnings in Shopify admin about the risk of service interruption and the action they can take.
* **April 1, 2027:** Affected Admin API requests using non-expiring offline access tokens return HTTP 403.

This schedule applies to existing public apps [previously covered](https://shopify.dev/changelog/posts/expiring-offline-access-tokens-required-for-all-public-apps-as-of-january-1-2027) by the January 1, 2027 deadline. The requirement for [public apps created on or after April 1, 2026](https://shopify.dev/changelog/posts/expiring-offline-access-tokens-required-for-public-apps-april-1-2026) remains in effect. Custom apps and apps created by merchants are excluded.

[Follow the migration guide ](https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens)to update token acquisition, migrate existing installations, and validate token storage and refresh handling.