---
title: Expiring offline access tokens explicitly disabled
description: >-
  Verifies React Router expiring offline-token configuration and
  refresh-metadata storage compatibility.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/expiring-offline-token
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/expiring-offline-token.md
---

# Expiring offline access tokens explicitly disabled

Verifies React Router expiring offline-token configuration and refresh-metadata storage compatibility.

| Detail | Value |
| - | - |
| Check ID | `EXPIRING_OFFLINE_TOKEN` |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## app/shopify.server.ts

```ts
import { shopifyApp } from "@shopify/shopify-app-react-router/server";


const shopify = shopifyApp({
  // Turning this off keeps long-lived offline tokens that never
  // rotate, so a leaked token stays valid until someone notices.
  future: { expiringOfflineAccessTokens: false },
  sessionStorage: new PrismaSessionStorage(prisma),
});
```

***

## How to fix

Enable `expiringOfflineAccessTokens` and ensure session storage persists expiry and refresh metadata.

For more detail, see [Migrate to expiring offline access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens). Public apps must use expiring offline tokens for GraphQL Admin API requests from January 1, 2027.

## app/shopify.server.ts

```ts
import { shopifyApp } from "@shopify/shopify-app-react-router/server";


const shopify = shopifyApp({
  future: { expiringOfflineAccessTokens: true },
  sessionStorage: new PrismaSessionStorage(prisma),
});


// Session storage has to persist the refresh metadata, or the
// tokens expire with nothing to renew them.
//
// // prisma/schema.prisma
// model Session {
//   expires             DateTime?
//   refreshToken        String?
//   refreshTokenExpires DateTime?
// }
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***