I want to rotate my shopify app key, i see that when we try to rotate we also see old key.
I want to know if my merchants need to reinstall my app after i rotate.
Hello, @tazapay-suraj
Hope things are going smoothly for you!
No, merchants shouldnât reinstall app. Shopify keeps the old secret available during the transition so you can update your app without disrupting existing installations.
Hey @tazapay-suraj
Custom-Cursorâs right that merchants donât reinstall, but the more important reason is worth knowing: rotating the secret doesnât invalidate the access tokens you already hold for installed shops. Those tokens were granted at OAuth and arenât tied to your client secret, so your existing API calls keep working untouched, no reinstall needed. The âyou still see the old keyâ is expected too, thatâs the deliberate transition window where both the old and new secret are valid at once.
What you actually need to do is update your app to use the new secret everywhere itâs referenced (webhook HMAC verification and OAuth/session token validation), deploy that, and confirm both still verify during the window. One important order of operations: donât revoke or remove the old secret until your updated app is fully deployed and verified, because any webhooks still arriving signed with the old secret will fail HMAC verification if you kill it too early. Once youâve cut over and confirmed, then remove the old one.
Hope that helps! If it did, a Like and Marking it as Solution goes a long way and helps others find the fix faster too.
Best,
Moeed
Hi Moeed Thanks for this information, also i tried doing this with test app first to check if all works fine, i notice that when i redirect back to shopify thank you page after completing payment i see that since my DB has old access_token for that a old stores this api is failing.
Also how long is old key is active from Shopify side?
Hi @tazapay-suraj,
You do not need to worry about your merchants. They do not need to reinstall your app when you rotate your API secret key.
The process is designed to prevent any downtime. When you start the rotation in your Partner Dashboard, Shopify provides a grace period where both your old secret and your new secret remain valid at the same time. This window usually lasts for 24 hours.
Your job as a developer is to update your app server with the new secret as soon as possible. Once your server is updated and you have verified that your HMAC signatures are still matching correctly, you can go back to the dashboard and finalize the rotation by revoking the old key. As long as you update your code within that 24 hour window, the transition will be completely invisible to your users.
Hope this helps.
Hi @PieLab Yes i understand that we donât merchants to reinstall, but i store access_token for shops when they are installed so for old stores this is not updating access_tokens, so when i try to get success redirect url (redirect back to shopify thank you page) this i use access token which is failing as its not updated after key rotation.
Hello there @tazapay-suraj
No, merchants should not have to reinstall the app if you rotate your appâs API key appropriately. Shopify retains the old key during the transition to allow you to update your app without breaking existing instalations. Be sure to have your app updated to use the new credentials before you revoke the old key. When all is tested and working you should be able to finish the rotation without your existing merchants having to do anything except keep using the app.
Hi @tazapay-suraj .
Good news, your merchants do not need to reinstall your app after rotating your API key.
The old key stays active for a short period after rotation, which is why you can still see it. This gives you time to update your app with the new key without any downtime for your merchants.
Just update your app code with the new key before the old one expires, and everything continues working seamlessly for your merchants without any reinstall needed.
Hi Team,
i am using offline token, so is there a way i can refresh access tokens for my old merchants if an want to rotate app key?