Shopify · api · fg-0333
Shopify offline access token stops working after an hour, or on January 1 2027 if it never expires
[API] Invalid API key or access token about an hour after install
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
Public apps must use expiring offline tokens for the GraphQL Admin API: new apps already, existing apps by 2027-01-01. Expiring tokens last one hour with a 90 day refresh token; a newly acquired token retires older ones, which stay valid until they expire, and a presented refresh token stops working once the newer one is used.
Fix
Request expiring=1 in token exchange, store the rotating refresh token, and refresh from one place per shop before expires_in runs out. Apps on the official templates refresh automatically.
Apply
POST https://{shop}.myshopify.com/admin/oauth/access_token
grant_type=refresh_token&client_id=...&client_secret=...&refresh_token=STORED_REFRESH_TOKEN
# persist the new access_token, expires_in, refresh_token, refresh_token_expires_in
# token exchange: add expiring=1Affects: Public Shopify apps calling the GraphQL Admin API; enforced for existing apps on 2027-01-01; not custom or merchant-created apps
Sources
- https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/offline-access-tokens
- https://shopify.dev/docs/apps/build/authentication-authorization/implement-token-exchange
- https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp