---
title: "Shopify Recover lost offline-token migration responses by retrying the exchange: 2026-09-29 | Harbyn"
description: "Shopify Recover lost offline-token migration responses by retrying the exchange, announced Sep 29, 2026."
canonical: "https://harbyn.com/changes/shopify/2026-09-29-more-resilient-token-exchanges-when-migrating-tokens-without-a-user-session"
last-updated: 2026-10-03
---

# Shopify Recover lost offline-token migration responses by retrying the exchange

Markdown version of <https://harbyn.com/changes/shopify/2026-09-29-more-resilient-token-exchanges-when-migrating-tokens-without-a-user-session>.

Behavior change - Shopify. low severity. In effect.

When migrating a non-expiring offline access token without a user session, retrying the exchange with the same original token and client credentials within seven days returns the same access-token and refresh-token pair. Shopify may extend the access token’s expiry, but not the refresh token’s expiry. Recovery ends after seven days, after the issued pair is successfully refreshed, or when a later token acquisition replaces it. The original token remains invalid for GraphQL Admin API requests after migration.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [Shopify](https://harbyn.com/vendors/shopify.md) |
| Kind | Behavior change |
| Severity | low |
| Status | In effect |
| Announced | Sep 29, 2026 |
| Added to Harbyn | Oct 3, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://shopify.dev/changelog/more-resilient-token-exchanges-when-migrating-tokens-without-a-user-session> |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses Shopify, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://shopify.dev/changelog/feed.xml> (changelog, fetched 2026-10-03 05:27 UTC, sha256 `8fa8550cc939244de80fdd1db7e7b30d257c21fa84af76ee054e9fa6f647c3e5`)

## Related changes

### More from Shopify

- [Sidekick can now invoke app intents without tools](https://harbyn.com/changes/shopify/2026-09-28-sidekick-can-now-invoke-app-intents-without-tools.md) (Breaking change, announced Sep 28, 2026)
- [Discounts can be part of Rollouts, exposed through Discount.rollouts](https://harbyn.com/changes/shopify/2026-10-01-discounts-can-now-be-included-in-rollouts.md) (Behavior change, announced Oct 1, 2026)
- [metafieldInteger collection conditions removed in API version 2027-01](https://harbyn.com/changes/shopify/2026-10-01-metafieldinteger-collection-condition-removed-in-api-version-2027-01.md) (Breaking change, announced Oct 1, 2026)
- [Tax calculated on return shipping fees for eligible US orders](https://harbyn.com/changes/shopify/2026-10-01-new-tax-fields-for-return-shipping-fees-in-the-graphql-admin-api-2.md) (Behavior change, effective Oct 23, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: ORDER\_CHANGE notifications add PreFulfillmentStatusChange for Amazon Autos](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-3.md) (effective Oct 28, 2026)
- [BigCommerce: 301 redirects will apply only to storefront channels](https://harbyn.com/changes/bigcommerce/2026-10-07-301-redirects-now-apply-to-storefront-channels-only.md) (effective Nov 10, 2026)
- [GitHub: Secret scanning audit log business field changes to enterprise slug](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-7.md) (effective Nov 12, 2026)
- [Jira / Atlassian Cloud: New IP address ranges in use from January 1, 2027](https://harbyn.com/changes/atlassian-jira/2026-10-16-atlassian-cloud-adds-new-ip-address-ranges.md) (effective Jan 1, 2027)

[All upcoming deadlines](https://harbyn.com/deadlines.md)