detektu
Shopify API changes
Info

More resilient refreshes for expiring offline access tokens

doc:019fb619-9b4a-74ac-a83e-3ffa98844fb4::feed/https://shopify.dev/changelog/more-resilient-refreshes-for-expiring-offline-access-tokens
Product
Shopify Admin GraphQL API
Source
Feed
Change kind
Feed Entry
Detected
Last updated

Deterministic evidence

Before / after

Extracted from Shopify's published contract. Open the source ↗

−1+81 change

1 / 1
null
{
"content_hash": "06a0bb030f7b19806a078564068b3315424adb7bbda319945fe2c9baf53ca423",
"excerpt": "Expiring offline access token refreshes now retain the previously used refresh token until an app begins using its replacement. This rollout helps apps recover when a refresh response is lost or isn’t persisted. No migration is required, but apps should continue to store every refreshed token pair atomically. What changed Previously, after an app used a refresh token, it could retry that token for up to 60 minutes. If the app didn’t receive or save the newly returned access token and refresh tok…",
"identity": "https://shopify.dev/changelog/more-resilient-refreshes-for-expiring-offline-access-tokens",
"link": "https://shopify.dev/changelog/more-resilient-refreshes-for-expiring-offline-access-tokens",
"published_at": "2026-08-28T14:00:00Z",
"title": "More resilient refreshes for expiring offline access tokens"
}

Interpreted documentation change

What the vendor announced

The bulletin describes an enhancement to token refresh behavior for offline access tokens: refreshes now retain the previously used refresh token until the app starts using its replacement, improving resilience if a refresh response is lost or not persisted. No migration is required, but apps should atomically store every refreshed token pair. It notes a previous behavior where a refresh could be retried for up to 60 minutes after use. There is no explicit deadline or endpoint replacement provided.

More resilient refreshes for expiring offline access tokens Expiring offline access token refreshes now retain the previously used refresh token until an app begins using its replacement. This rollout helps apps recover when a refresh response is lost or isn’t persisted. No migration is required, but apps should continue to store every refreshed token pair atomically. What changed Previously, after an app used a refresh token, it could retry that token for up to 60 minutes. If the app didn’t receive or save the newly returned access token and refresh tok…

Vendor source ↗

Monitored for you

Does this change affect your integration?

Choose the operations and fields your services use. Detektu matches Shopify findings to that declared usage so your team can review the relevant evidence. No agent or repository access required.

Monitor Shopify free See pricing

Multi-source correlation

Other Shopify findings correlated with this change across sources.

  1. Deprecation
    SDK version 12.2.0 yankedsdk:npm/@shopify/shopify-api@12.2.0
    Shopify Admin GraphQL API
  2. Info
    SDK release 14.0.1sdk:npm/@shopify/shopify-api@14.0.1
    Shopify Admin GraphQL API
  3. Info
    SDK release 14.0.1sdk:npm/@shopify/shopify-api@14.0.1
    Shopify Admin GraphQL API