Shopify announced a new security requirement effective April 1, 2026: all newly created public apps that access the Admin API must use expiring offline access tokens instead of indefinite ones. This change applies only to public apps created on or after the April 1 deadline. Existing public apps, custom apps, and merchant-created apps are not affected by this requirement.
Expiring offline access tokens significantly enhance merchant data protection by limiting the window of vulnerability if a token is compromised. Rather than tokens remaining valid indefinitely, they now have a defined lifespan, forcing developers to implement token refresh mechanisms and maintain better security practices. This aligns with modern OAuth best practices and reduces the risk of unauthorized long-term access to merchant data across Shopify stores.
GetShopifyToken simplifies secure token management for Shopify developers by providing robust handling of both standard and expiring offline access tokens. Our platform helps you implement token refresh workflows efficiently, ensuring your apps remain compliant with Shopify's evolving security standards while maintaining reliable merchant access.