Existing public apps must use expiring offline access tokens by January 1, 2027

[PhiloNL]

The usage of offline access tokens will be required for all apps at the start of next year: https://community.shopify.dev/t/action-required-existing-public-apps-must-use-expiring-offline-access-tokens-by-january-1-2027/34527

Offline access tokens are already supported thanks to @JonPurvis:
Support expiring offline access tokens #471

@JonPurvis does your implementation automatically transitions users from the old permanent token to the expiring token when SHOPIFY_EXPIRING_OFFLINE_TOKENS=true or do we still need a migration path?

[JonPurvis]

My implementation will only work for users going forward. Existing users on apps will still have old tokens.

To put it in another way, based on https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/offline-access-tokens#step-4-migrate-existing-tokens, my implementation only covers steps 1-3.

We could add step 4 to this package as an optional artisan command or something though. I can take a look at that later this week.

[JonPurvis]

Actually, I'll probably look into it later today

[JonPurvis]

@PhiloNL #488

I'm going to test it on more of my apps later today, but I believe this is the missing step needed.

[Kyon147]

@JonPurvis an optional command makes sense or a flag in the config, I did wonder when Shopify will force all merchants over to expiring tokens as I didn't think they'll let any app use fully offline tokens forever anymore.

Let me know if you need any help as the command would not work for my apps as they are serverless. So thinking of the best way to make it work for everyone on different stacks.

Note: I could make it work but it would be more of a pain than a env/config thing.

[JonPurvis]

Yeah I was somewhat expecting this to happen 😆

[PhiloNL]

Just got a reply to a concern of mine and it looks like non-expiring and expiring both tokens can be used until January 1st:

https://community.shopify.dev/t/action-required-existing-public-apps-must-use-expiring-offline-access-tokens-by-january-1-2027/34527/5

Which is nice, so there's a backup in case something goes wrong. So preferably we keep the offline token until chosen to wipe the non-expiring tokens.

[JonPurvis]

That is certainly helpful!

[JonPurvis]

Hey @Kyon147

I've been thinking about your comment and I've just pushed an update to the branch. I refactored it so the command now just chunks users/stores and kicks off queue jobs instead. This will work much better if the Shopify API suffers a blip during a run too!

Would this work for your setup?

[JonPurvis]

Closing this issue now. PRs are merged and released for this package to support existing and new stores. A new wiki article has been created, which will guide folks through how to migrate - https://github.com/Kyon147/laravel-shopify/wiki/Expiring-Offline-Access-Tokens