Online and offline tokens for embedded apps

Last updated Oct 23, 2026 View as Markdown

You can ask for an online token with requested_token_type=urn:youcan:params:oauth:token-type:online-access-token.
An online token is tied to the person who opened your app.
An online token is valid for 24 hours, with no refresh token.
An online token's scopes are cut down to that person's store permissions.
You get associated_user and associated_user_scope in the response of an online exchange.
You get the same offline token on every exchange for one store. Its scopes are updated to your app's current scopes.
The standard token exchange parameters are accepted: grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token and subject_token_type=urn:ietf:params:oauth:token-type:id_token.
grant_type=token_exchange with session_token is still accepted.
Session tokens are valid for 1 minute instead of 5.
See Token types.

Online and offline tokens for embedded apps ​