Shopify Token Migration: Offline → Online Tokens

Background

All Shopify integrations with EcartAPI currently operate using Offline tokens — access tokens with an indefinite lifetime. Starting January 1, 2027, Shopify will exclusively support tokens with an expiry and a refresh token mechanism.

In practical terms, Shopify integrations will no longer use permanent tokens. Each access token will now have a limited lifetime, and a refresh token is used to obtain a new one before it expires. EcartAPI handles this process transparently so that your integrations remain uninterrupted.

What EcartAPI does automatically

Starting August 10, 2026, EcartAPI will migrate Shopify integrations from Offline to Online tokens automatically using Shopify's Token Exchange API. No action is required from you or your customers, as long as your Shopify application credentials are configured in your EcartAPI dashboard.

The migration process works as follows:

1. When a request is made for an integrated Shopify store that still has a legacy Offline token, EcartAPI automatically calls Shopify's Token Exchange API to convert it to a new Online token.
2. The legacy token is replaced — the integration continues without any disruption.
3. From that point on, EcartAPI silently refreshes the token using the stored refresh token before it expires, on every subsequent request.

New integrations created after this migration process begins will generate Online tokens from the start — no migration step is needed for them.

What you need to verify

For the automatic migration to work, the Client ID and Client Secret of your Shopify application must be configured in your EcartAPI app and must match the credentials of the Shopify app your stores are connected to.

To verify this:

1. Go to your EcartAPI Dashboard.
2. Navigate to My Apps → select your application.
3. Go to E-commerce Setup → Shopify.
4. Confirm that the Client ID and Client Secret shown match the App Key and App Secret of your Shopify application.

If they match, no further action is needed — EcartAPI will handle everything on the next API request from each connected store.

Important: If the credentials already match, do not regenerate or rotate your Shopify application's Client ID or Client Secret. Doing so invalidates all existing Shopify integrations associated with those credentials, requiring each connected store to be re-authorized.

If your app credentials are not configured in EcartAPI

If you do not have a Client ID and Client Secret registered in EcartAPI for your Shopify integrations, EcartAPI cannot perform the automatic migration on your behalf. In this case, you are responsible for managing token migration and refresh.

Both the initial migration (legacy Offline → Online) and subsequent token refreshes use the same endpoint:

POST /api/v2/refreshtoken

Request

curl --location 'https://api.ecartapi.com/api/v2/refreshtoken' \
--header 'Authorization: Bearer <store_access_token>' \
--header 'Content-Type: application/json' \
--data '{
    "clientId": "<your_shopify_app_client_id>",
    "clientSecret": "<your_shopify_app_client_secret>"
}'

Response

A successful call returns the updated access information for the integration, including the new access token and its expiry.

{
  "success": true,
  "data": {
    "accessToken": "...",
    "refreshToken": "...",
    "accessTokenExpiresIn": "...",
    "refreshTokenExpiresIn": "..."
  }
}

When to call this endpoint

Token lifetimes at a glance:

The recommended flow is:

1. Make your API call normally using the store access token.
2. If you receive a 401, call POST /api/v2/refreshtoken to obtain a new access token.
3. Retry the original request with the new token.
4. If POST /api/v2/refreshtoken also returns an error because the refresh token has expired, the integration is no longer recoverable via token refresh — the store must re-integrate.

Summary

If you have any questions, contact the EcartAPI support team.