Use expiring offline access tokens (required)
Request expiring offline access tokens, and store each refresh token as carefully as the access token.
Your app uses offline access tokens to call the GraphQL Admin API when no one has the app open, such as from background jobs and webhook handlers. A non-expiring offline access token stays valid until the store uninstalls your app or you revoke your client secret, so if one leaks, then whoever holds it keeps your app's access to that store. An expiring offline access token lasts one hour, so a stolen token stops working on its own, and Shopify replaces its refresh token every time your app uses it.
Public apps must use expiring offline access tokens for GraphQL Admin API requests. Starting January 1, 2027, Shopify rejects GraphQL Admin API requests from public apps that use a non-expiring offline access token.
Newly scaffolded apps request expiring tokens through the expiringOfflineAccessTokens flag in shopifyApp(). To move an existing app, see Migrate to expiring offline access tokens.
If your app has public distribution, then it can also get application-only access tokens for scheduled jobs and webhook handlers. Your server signs a short-lived client assertion with a private key instead of sending your client secret. The token lasts up to one hour and has no refresh token, so your server requests a new one when it needs it.