Expiring access tokens: another step in making Metafields Guru more secure
Metafields Guru has moved to expiring access tokens. The key the app uses to work with your store is now short-lived: it expires on its own after a short time, is replaced automatically, and is never kept in our database. That makes your store's data even better protected, and it means Metafields Guru already meets Shopify's newest security requirements for apps. You don't need to do anything - the app works exactly as before.
What's new at a glance
- Short-lived by design - access tokens expire on their own and are replaced automatically, so there is no long-lived key to your store.
- Nothing stored to steal - tokens are never saved in our database.
- Ready for Shopify's new rules - the app already meets Shopify's requirement for expiring tokens, well ahead of the deadline.
- Nothing for you to do - no reinstall, no new settings, no downtime.
Why it matters
To read and update data in your store, every Shopify app uses an access token - a digital key that Shopify checks on each request. Until now, that kind of key could stay valid for as long as the app was installed.
With expiring tokens, every key Metafields Guru uses has a short lifetime and then simply stops working. Our servers request a fresh one from Shopify when it's needed, and the old one is never written to a database. Even in the unlikely event that a token ever ended up in the wrong hands, it would be useless within a short time.
In Settings → Apps → Metafields Guru, the Security section may still show Expiring access tokens - "Makes the app regularly confirm it's allowed to connect" - as Missing for up to two weeks. Shopify's internal check looks back at roughly the last two weeks of the app's activity, so the old tokens used before the switch keep the warning on for a while. This is normal and clears up on its own - unfortunately, there is nothing we can do on our side to speed it up.
One more step, not the last one
Security isn't a single feature for us - it's ongoing work, and this update is one of many steps in it. Just last week we enforced IP restrictions, so Shopify only accepts the app's requests when they come from our own trusted servers. Together, the two make a strong pair: a token is valid only for a short time, and only from our servers.
Before that, we responded the same day to the October 2026 PHP and Node.js vulnerabilities, keeping every server on the fixed release. And we'll keep going - more improvements are already on the way.
FAQ
Do I need to do anything after this change?
No. There is nothing to reinstall, approve, or set up. New tokens are issued automatically in the background, and the app works exactly as before.
Will I notice any difference in how the app works?
No. Editing, imports, exports, bulk edits, and every other feature keep working the same way. The change only affects how the app proves to Shopify that it is allowed to access your store.
Why does my Shopify admin still show Expiring access tokens as Missing?
Shopify updates this status based on its own internal check, which looks at whether an app has used old, non-expiring tokens over roughly the last two weeks. Until that period passes, the Security section of the app page may still show Expiring access tokens as Missing. This is expected, it clears up on its own, and unfortunately we cannot speed it up from our side.
Does Shopify require expiring access tokens?
Yes. Shopify requires public apps to use expiring access tokens for Admin API requests by January 1, 2027. Metafields Guru has already made the switch, well ahead of the deadline.
Questions?
Our support team is always happy to help with anything related to this update. New to the app? Install it from the Shopify App Store or start with the introduction.