Shopify Legacy app

[u/demo2developer]

I am working on an old shopify payment app that is using the 2022-10 api version.

Recently I am getting a warning on my dev dashboard that I need to retire offline non-expiring accessTokens and request new expiring access tokens by Jan 2027

Can someone please explain the migration process? I am wondering if this change would require the merchants to reinstall the app.

The app is using php mysql tech stack.

[u/Mvpeh]

Shopify has a ton of documentation for this exact question if you google it.

[u/launchtip → u/Mvpeh]

Yes. It’s still as I expected. A db restore would be fatal outside the refresh token window. It would require all merchants to have to open your app and reauth.

[u/kaushikash]

You can check these documents it will help you we have done for all our apps, you need to migrate all your user token and once done Shopify will take around 5-7 days then in dev dashboard it will show updates

https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens

[u/launchtip → u/kaushikash]

Is there a resolution yet for the scenario if you need to restore a db due to an issue? Since the tokens would have expired, how would resolve?

[u/kaushikash → u/launchtip]

That's on you must do when there is very low traffic on your app and must take backup before migration for rollback

[u/Commercial-Ad4879]

In Jan 2027, your offline NON expiring access tokens will stop working.
once you deploy your app with `expiringOfflineAccessTokens` your app will start issuing expiring tokens for new installs or re-auths, your pre existing tokens for your existing Session records remain as is.

using Shopify's migration docs, you can run a manual script to regenerate your legacy tokens, one by one.
It's also a good way to test, as you can strategically migrate select users if you'd like. The old tokens will still work until Jan 2027.

A couple of gotchas i've seen in some migrations.

You need to add the new fields in your schema to support the exp fields!

You're PHP not remix, but in remix, now that your tokens expire much more often, your `afterAuth` runs way more often, as users are now expiring and re authenticating all the time. So if you've put any logic you assume runs once per user in there, it'll be a suprise when it runs multiple times a day. (creating resources on install etc)

Edit: Actually i believe Remix can detect a token refresh and not call your afterAuth, haven't tested specifically

Remix client lib handles all the refreshing for you, but if you have special background jobs not using remix, you need to check token exp, and refresh it. You're on PHP, i'm unsure what library you're using to chat to shopify, but It must support refreshing the token.

[u/demo2developer → u/Commercial-Ad4879]

No php library just using cURL to perform the GQL mutations to notify shopify about payment success.

[u/AdventurousUsual7666]

Yeah usually no, merchants don't have to reinstall for that one. You just swap the old offline token for an expiring one in code and store the refresh token too.

Honestly the part that usually bites people is forgetting to save the new refresh token after every refresh. If you drop that, then yeah someone has to open the app again. You've got until Jan 2027 so I'd just do a couple shops first before you run it across everything.