---
title: Use expiring offline access tokens (required)
description: >-
  Request expiring offline access tokens so a stolen token stops working on its
  own. Public apps must use them from January 1, 2027.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/use-expiring-offline-access-tokens
  md: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/use-expiring-offline-access-tokens.md
---

# Use expiring offline access tokens (required)

Request [expiring offline access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens#token-lifetimes), and store each refresh token as carefully as the access token.

***

## Why

Your app uses offline access tokens to call the GraphQL Admin API when no one has the app open, such as from background jobs and webhook handlers. A non-expiring offline access token stays valid until the store uninstalls your app or you revoke your client secret, so if one leaks, then whoever holds it keeps your app's access to that store. An expiring offline access token lasts one hour, so a stolen token stops working on its own, and Shopify replaces its refresh token every time your app uses it.

[Public apps must use expiring offline access tokens](https://shopify.dev/changelog/expiring-offline-access-tokens-required-for-all-public-apps-as-of-january-1-2027) for GraphQL Admin API requests. Starting January 1, 2027, Shopify rejects GraphQL Admin API requests that use a non-expiring offline access token.

***

## How

Newly scaffolded apps request expiring tokens through the `expiringOfflineAccessTokens` flag in `shopifyApp()`. To move an existing app, see [Migrate to expiring offline access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens).

***