Hi Dan,
Are you using the latest version of Shopify App Bridge? Take a look at this doc in the section “Conversion pattern steps” step #3. It says to make a timed event to refresh session tokens, that sounds about right for cookie-less auth and Shopify embedded apps.
Best,
Sam - Owner [email removed] Achieve Applabs