What is the validity period of a customer access token in an online store?

Shopify Plus
1

Hello,

We are currently encountering an issue with customer access tokens within our Shopify storefront. Our website operates without a session time functionality. When a user logs in, we create a customer access token using their username or password. However, after a span of 4 to 7, when attempting to add an item to the cart, we are receiving an error stating “Customer Is Invalid.”

We suspect this error might be due to the expiration of the customer access token. Could someone kindly clarify the duration for which a customer access token remains valid before expiration? Understanding this time frame will help us address the issue more effectively.

Please find below my query to generate the customer access token.

`mutation {
                   customerAccessTokenCreate(input: {email: "${email}", password:"${params.get('password')}"}) {
                     customerAccessToken {
                       accessToken
                       expiresAt
                   }
                   customerUserErrors {
                       code
                       field
                       message
                   }
                   userErrors {
                       field
                       message
                   }
               }
           }`;
2

have you use customerCreate before customerAccessTokenCreate ?

3

Hi @Dev110

The error “Customer Is Invalid” confirms that your access token has expired. By default, Shopify Storefront Customer Access Tokens are valid for approximately 6 weeks (45 days) from creation, though this can vary. You can verify the exact expiration time for any specific user by logging the expiresAt value that is already present in your mutation response.

To combat this, you should not force the user to log in again. Instead, implement the customerAccessTokenRenew mutation. Your application should check the stored expiresAt date in the background; if the token is expired or close to expiring, use the renewal mutation to silently generate a fresh token so the user can continue their session without interruption.

Hope this helps!

4

@Dev110 ,

You’re on the right track this is an access-token expiration issue, and the behavior you’re seeing matches Shopify’s design exactly.

  1. Always store expiresAt

When creating the token, save both:

{
  "accessToken": "...",
  "expiresAt": "2026-01-28T14:32:00Z"
}
  1. Check token expiry BEFORE using it

Before any customer action (add to cart, checkout, etc.):

if (new Date(expiresAt) <= new Date()) {
  // Token expired
  // Re-authenticate or refresh
}
  1. Re-authenticate when expired (Required)

Shopify does NOT provide a refresh token for customers.

So when expired, you must:

Ask the user to log in again OR
Transparently re-create the token

mutation {
  customerAccessTokenCreate(input: {
    email: "...",
    password: "..."
  }) {
    customerAccessToken {
      accessToken
      expiresAt
    }
  }
}