Shopify’s Token Shift Opens a Market for Integration Monitoring

What changes before an app suddenly stops working

Shopify will no longer allow public apps in its app marketplace to use non-expiring access tokens for management functions. An access token is a temporary key that proves an app is allowed to access a merchant’s order, inventory, and customer data.

Apps that do not migrate will be removed from the Shopify App Store and blocked from new installations from January 1, 2027. Existing installations will not stop immediately. But Shopify’s latest schedule says merchants will see warnings in their admin screens about potential service interruption from January 15, and affected management-function requests will begin failing with access-denied errors from April 1.

A new access token is usually valid for one hour. The app must use a separate refresh token to obtain a new one, and the initial refresh token is usually valid for 90 days. Previously, an app could keep the key received at installation for a long time. Now it must continually replace keys and store the replacement result safely.

App operators can migrate existing installed stores in the background without requiring merchants to reinstall the app. But once a migration succeeds, the old token is permanently invalidated for GraphQL Admin API use. Teams must therefore test even the case where they receive a new token but fail to save it. If the response from the first exchange is lost, recovery can be attempted within seven days, but this should not be treated as a normal operating path.

The change applies to public apps that call management functions with legacy non-expiring tokens. Custom apps built for a specific merchant and apps created by merchants themselves are excluded. Operators should ask Shopify directly about unusual integrations where it is unclear whether a management function is subject to enforcement.

The first customer is not the merchant using the app, but the app operator

Assume a team of six people operates one public app. The app sends orders from dozens of domestic ecommerce brands to a logistics system, then sends inventory quantities back to Shopify after fulfilment. Because it must run overnight, tokens used while merchants are away from the app matter.

Today, this operator is likely to have a developer inspect storage records for signs of old-token use, copy store addresses into a document, and migrate them one by one. It would then separately test order retrieval, inventory updates, and customer-data connections, recording the result again. Each store may have a different time when warnings disappear, making omissions easy.

The harder problem is not replacing a token once. If several processes at one store request a new token at the same time, values can conflict. If refresh succeeds but storage fails, the connection can break from the next order onward. For stores that have barely used the app for 90 days, or have revoked permissions, the operator may need to ask the merchant to open the app again.

After migration, each store could show one of four states in one place: “using the old method,” “replacement complete,” “workflows verified,” and “merchant action required.” Reading a test order and checking one inventory record immediately after replacement, then repeating the same checks at the next refresh, separates proof that a token was issued from proof that real work continues.

Some work still needs people. Someone must agree a migration time with the merchant, reprocess a failed inventory update, and explain why a merchant needs to approve new permissions. The service should not replace those decisions. It should narrow down who needs to be contacted and what failed.

The first ten likely paying customers are operators of older public apps that periodically pull order, inventory, and customer data from multiple stores in the background. Candidates can be narrowed down by looking in the Shopify App Store for Korean-language-support apps that offer order export, inventory synchronisation, customer management, or settlement functions. Operators asking about non-expiring-token warnings in Shopify developer communities are also direct prospects.

Their current tools may include a developer’s temporary query, a shared document, error alerts, and merchant enquiries. If any of these are true — “we cannot immediately make a list of affected stores,” “we migrated but the warning returned,” or “we only learn about an outage when a merchant tells us” — there is a reason to pay for a monitoring service.

Early apps designed operations, not just the replacement

The US data migration app Altera – Export and Import serves merchants exporting product, order, and customer data to files or moving it to another store. Because tokens can change during long-running work, it prevented overlapping refreshes for a single store. It began with test stores, then rolled out to 10%, 50%, and 100% of new installations.

It migrated existing installed stores in groups. At the time of writing, the operator said it had identified no user impact. This is not a result from a completed full migration, and it is the operator’s own statement. The key lesson is not “replace everything at once,” but verify with a subset of stores first.

The US Celigo Shopify–NetSuite Integration App connects Shopify order, inventory, and refund data with NetSuite, an enterprise management system. Celigo said it would change tokens on company servers without merchant reinstallation, while consolidating stores linked to multiple Celigo accounts under one primary account.

Celigo announced plans to migrate eligible connections from November 1 to 15, 2026. The work is still planned, so no completion rate has been published. But resolving account structure before asking merchants to reinstall is useful for agencies that manage multiple client accounts.

Microsoft’s Business Central Shopify Connector connects products, prices, inventory, customers, and orders with Shopify. It checks for token expiry immediately before every connection, refreshes automatically starting five minutes before expiry, and controls the sequence so refreshes do not happen simultaneously for one store.

This capability was reflected in implementation documentation in July 2026. If the refresh token itself expires, it does not quietly stop work. Instead, it asks the user to reconnect the store, showing the moment where automatic recovery is no longer possible.

Four things to build right away

1. Find affected stores

• What it does: Reads an app’s recent connection records and gathers stores using old tokens with their last-use times.
• Who uses it: A Korean Shopify app company that has operated an order or inventory integration app since before April 2026.
• Why now: New installations will be blocked from January 2027, so teams need to understand the scope before building the migration.
• First screen: Groups all stores into four buckets: “not migrated,” “no recent use,” “migration complete,” and “needs review.”

2. Per-merchant migration board

• What it does: Manages the migration date, owner, advance notice, replacement result, and whether each merchant needs to reconnect.
• Who uses it: An ecommerce implementation agency that manages Shopify apps and logistics integrations for multiple clients.
• Why now: Even within one app, each store has different operating hours and contacts, so shared documents alone make omissions hard to prevent.
• First screen: Places the migration schedule by date alongside merchants not yet contacted and stores to retry after failure.

3. Order and inventory connection health check

• What it does: Runs small checks such as reading an order and retrieving inventory immediately after a token refresh, then alerts on failure.
• Who uses it: A brand operations team where a stopped overnight order collection or multi-channel inventory synchronisation delays next-day fulfilment.
• Why now: Confirming a successful token replacement alone does not show whether order and inventory work continues.
• First screen: Prominently shows the last successful order check, last successful inventory check, and next token refresh time.

4. Merchant reconnection guide

• What it does: Gives step-by-step instructions for stores where automatic refresh is impossible, asking the merchant to reopen the app and complete required approvals.
• Who uses it: An ecommerce manager at a Korean brand who is comfortable with Shopify admin but does not understand an app’s permission model.
• Why now: A store unused for more than 90 days, or one with invalidated permissions, may not be recoverable through operator action alone.
• First screen: Shows only a “Restart connection” button, the affected order and inventory functions, the expected steps, and the completion result.

One call to make today

Spend 15 minutes with one Shopify app operator you know. Ask only whether they can produce a list of affected stores immediately, and how they will verify order and inventory connections after token replacement. If either answer is a shared document or a developer’s manual check, the problem is worth sketching a first screen for.

Why this matters where you are

Any platform that replaces long-lived app credentials with expiring credentials can create the same gap between a completed migration and a working integration. Check whether the platforms your products depend on require token refresh, merchant reauthorisation, or staged migration. If they do, map the affected accounts and define a small workflow check that proves the real job still works.