Access token for custom app keeps expiring

Shopify Discussion
1

For a custom app we created for automatically developing delivery note once order is placed for our site, the Shopify access token keeps expiring after a couple of days. Even after refreshing via OAuth, it again expires after a couple of days. What is causing this and how can this be fixed?

2

f you generate the Custom App access token using your Client ID and Client Secret via the Client Credentials flow, this token expires after 24 hours by default. You will need to obtain and refresh a new one once it expires.

3

Hi @CW5

Your custom app is using a method where the access token automatically expires after 24 hours. There is no refresh token, so it will expire every time, even if you keep using it. This is normal behavior, not a bug.
If it sometimes works for a couple of days, it usually means your system is reusing the same token and only tries to get a new one after it stops working, instead of refreshing it before it expires.

To fix this, you need to handle token renewal automatically in your backend.
Before making any Shopify API call, check if the token is expired or about to expire (for example, within 30 minutes). If it is, request a new token using your client ID and client secret.
Then store the new token on your server along with its expiry time. Don’t hardcode the token or save it permanently — treat it as temporary and always refresh it through code when needed. You can do it like this:

if token_expires_at < now + 30_minutes:
    token = fetch_new_token(client_id, client_secret)
    store_token(token, expires_at = now + 24_hours)

call_shopify_api(token)

Here are a few things you should check.
Make sure the token is stored only on the backend and never in frontend JavaScript or exposed in the browser. Since your delivery notes are generated from the backend, this should already be fine.
Also, confirm that your client_id and client_secret are taken from the correct app in the Shopify Dev Dashboard and match the store where the app is installed.

Check that you are using client_id and client_secret in your request, not old api_key format, because that can cause OAuth errors.
For your delivery note flow, since it runs automatically when an order is created, the best setup is this: when the orders/create webhook is triggered, your backend should first check if the token is still valid. If it is expired, generate a new one, and then continue with the Shopify API call to create the delivery note.
This way, everything works automatically in the background and you don’t need to manually generate tokens again.

Thank You

4

Thank you @mastroke . Will try this and let you know. Thanks.