Online & offline session tokens

[Anonymous]

Is it possible throughout the app installation process to request both online and offline session tokens?

I will need an offline token to perform API requests in background tasks and an online token for the logged in user, to perform requests from the front end. 

Also, are online tokens restricted to Shopify Plus or can they be requested in by any app regardless of the Shop account type? 

[Luke_K · Accepted solution]

Hey @Anonymous 

Yes - Offline and Online Tokens can be used simultaneously by using different access tokens.  They are requested during the OAuth process.

There's a run through here of offline and online access here too if it helps. 

There's no restrictions of online access tokens to Plus Stores. Please let me know if you have any further questions - thanks!

[Anonymous]

Thanks for getting back to me.

What is the flow for creating both token types? Should I request an offline token when the app is installed, and then pass the user through oauth a second time to get the online token? As the online token has a limited lifespan, the user will then need to pass though oauth intermittently to refresh the token. Is this correct or is there a best practice for handling this?

[dygerati]

I'm also wondering the same here. Just using the provided koa app, and I'd like to fetch both online and offline tokens. 

Any clues as to the flow here?

[Anonymous]

Hi @dygerati 

The recommended flow is to request a (permanent) offline token when the app is installed and store that in your app's backend. Then after installation, pass the user through oauth again to request an online (session) token. There shouldn't be any need for any interaction from the user for the second pass as long as you keep the scopes the same.  

[amt_dev]

@dygerati  How can this be achieved ? I am using@Shopify/shopify-api  to create my app and KOA is deprecated