Token Exchange support

[sebastianpisula]

Maybe support for Token Exchange?

https://shopify.dev/docs/apps/auth/get-access-tokens/token-exchange/getting-started

[github-actions]

This issue is stale because it has been open for 60 days with no activity. It will be closed if no further action occurs in 14 days.

[github-actions]

We are closing this issue because it has been inactive for a few months.
This probably means that it is not reproducible or it has been fixed in a newer version.
If it’s an enhancement and hasn’t been taken on since it was submitted, then it seems other issues have taken priority.

If you still encounter this issue with the latest stable version, please reopen using the issue template. You can also contribute directly by submitting a pull request– see the CONTRIBUTING.md file for guidelines

Thank you!

[jhardin-accumula]

When this was automatically closed in July 2024, token exchange was a convenience over the authorization-code-grant flow.

Since then, in December 2025 Shopify announced that offline access tokens support expiry + refresh (changelog), and then the follow-on April 1, 2026 requirement making expiring offline tokens mandatory for new public apps. While no timeline for retiring permanent tokens for grandfathered apps has been announced, that is a logical next step.

As of v6.1.1, the PHP SDK still has no TokenExchange helper, no refresh_token / refresh_token_expires_at fields on Session, no parsing of expires_in / refresh_token / refresh_token_expires_in in OAuth::callback or AccessTokenResponse, and no grant_type=refresh_token helper - features all present in JS @shopify/shopify-api via auth.tokenExchange() and related APIs. PHP apps building for the new model have to implement custom code for the token-exchange acquisition grant (online and offline, with optional expiring=1), the non-expiring-to-expiring migration exchange, and the refresh grant with single-use-refresh-token collision handling - plus carrying refresh-token state somewhere out-of-band from Session.

Is official PHP SDK support for token exchange + expiring offline tokens on the roadmap now?

If maintainers are open to it but unstaffed, community contribution via PR may be viable - a clear statement either way would help app teams plan their implementations.

Thanks.

(Unable to reopen directly - opened new issue #462 for this.)