diff --git a/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java b/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
index d8725038f..d32749adf 100644
--- a/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
+++ b/src/main/java/au/com/royalpay/payment/manage/dev/web/TestController.java
@@ -24,6 +24,7 @@ import au.com.royalpay.payment.manage.merchants.beans.NewSubMerchantIdApply;
 import au.com.royalpay.payment.manage.merchants.core.ClientManager;
 import au.com.royalpay.payment.manage.permission.manager.ManagerMapping;
 import au.com.royalpay.payment.manage.pos.datasource.ReadOnlyConnection;
+import au.com.royalpay.payment.manage.shopify.auth.domain.manage.ShopifyManageService;
 import au.com.royalpay.payment.manage.system.core.TradeSecureService;
 import au.com.royalpay.payment.manage.tradelog.beans.TradeLogQuery;
 import au.com.royalpay.payment.manage.tradelog.core.TradeLogService;
@@ -131,6 +132,9 @@ public class TestController {
     @Resource
     private MerchantChannelApplicationManager merchantChannelApplicationManager;
 
+    @Resource
+    private ShopifyManageService shopifyManageService;
+
     @Resource
     private AlipayRegisterService alipayRegisterService;
 
@@ -833,4 +837,10 @@ public class TestController {
 
         alipayRegisterService.batchUpdateAlipayApply();
     }
+
+    @ManagerMapping(value = "/shopify/rotate_secret", method = RequestMethod.POST, role = ManagerRole.DEVELOPER)
+    public JSONObject rotateShopifySecret(@RequestBody JSONObject rotateRequest) {
+        shopifyManageService.rotateAccessToken(rotateRequest.getString("secret"), rotateRequest.getString("refresh_token"));
+        return new JSONObject();
+    }
 }
diff --git a/src/main/java/au/com/royalpay/payment/manage/mappers/shopify/ShopifyStoreMapper.java b/src/main/java/au/com/royalpay/payment/manage/mappers/shopify/ShopifyStoreMapper.java
index 985029eee..c511fd10d 100644
--- a/src/main/java/au/com/royalpay/payment/manage/mappers/shopify/ShopifyStoreMapper.java
+++ b/src/main/java/au/com/royalpay/payment/manage/mappers/shopify/ShopifyStoreMapper.java
@@ -1,12 +1,15 @@
 package au.com.royalpay.payment.manage.mappers.shopify;
 
 import au.com.royalpay.payment.manage.shopify.store.domain.entity.ShopifyStore;
+import com.yixsoft.support.mybatis.autosql.annotations.AdvanceSelect;
 import com.yixsoft.support.mybatis.autosql.annotations.AutoMapper;
 import com.yixsoft.support.mybatis.autosql.annotations.AutoSql;
 import com.yixsoft.support.mybatis.autosql.annotations.SqlType;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.executor.keygen.Jdbc3KeyGenerator;
 
+import java.util.List;
+
 @AutoMapper(tablename = "shopify_store", pkName = "id", keyGenerator = Jdbc3KeyGenerator.class)
 public interface ShopifyStoreMapper {
 
@@ -18,4 +21,7 @@ public interface ShopifyStoreMapper {
 
     @AutoSql(SqlType.UPDATE)
     void update(ShopifyStore shopifyStore);
+
+    @AdvanceSelect(addonWhereClause = "status=1")
+    List<ShopifyStore> listAvailableStores();
 }
diff --git a/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/manage/ShopifyManageService.java b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/manage/ShopifyManageService.java
new file mode 100644
index 000000000..f7571c147
--- /dev/null
+++ b/src/main/java/au/com/royalpay/payment/manage/shopify/auth/domain/manage/ShopifyManageService.java
@@ -0,0 +1,34 @@
+package au.com.royalpay.payment.manage.shopify.auth.domain.manage;
+
+import au.com.royalpay.payment.manage.mappers.shopify.ShopifyStoreMapper;
+import au.com.royalpay.payment.manage.shopify.store.domain.entity.ShopifyStore;
+import au.com.royalpay.shopify.config.ShopifyAuthProvider;
+import au.com.royalpay.shopify.entity.ShopifyAccessToken;
+import au.com.royalpay.shopify.service.ShopifyAuthService;
+import org.springframework.stereotype.Service;
+
+@Service
+public class ShopifyManageService {
+
+    private final ShopifyAuthProvider shopifyAuthProvider;
+    private final ShopifyAuthService shopifyAuthService;
+    private final ShopifyStoreMapper shopifyStoreMapper;
+
+    public ShopifyManageService(ShopifyAuthProvider shopifyAuthProvider, ShopifyAuthService shopifyAuthService, ShopifyStoreMapper shopifyStoreMapper) {
+        this.shopifyAuthProvider = shopifyAuthProvider;
+        this.shopifyAuthService = shopifyAuthService;
+        this.shopifyStoreMapper = shopifyStoreMapper;
+    }
+
+    public void rotateAccessToken(String newSecret, String refreshToken) {
+        shopifyAuthProvider.addSecret(newSecret);
+        shopifyStoreMapper.listAvailableStores().parallelStream().filter(store -> !store.getTokenSecret().equalsIgnoreCase(newSecret))
+                .forEach(store -> rotateStoreAccessToken(store, refreshToken));
+        shopifyAuthProvider.activateSecret(newSecret);
+    }
+
+    public void rotateStoreAccessToken(ShopifyStore store, String refreshToken) {
+        ShopifyAccessToken newToken = shopifyAuthService.rotateAccessToken(store.storeName(), refreshToken, store.getAccessToken());
+        shopifyStoreMapper.update(ShopifyStore.builder().id(store.getId()).accessToken(newToken.getAccess_token()).tokenSecret(newToken.getSecret()).build());
+    }
+}
diff --git a/src/main/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStore.java b/src/main/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStore.java
index 142840601..0969060d0 100644
--- a/src/main/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStore.java
+++ b/src/main/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStore.java
@@ -9,6 +9,8 @@ import lombok.experimental.Accessors;
 
 import java.util.Date;
 import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 @Data
 @Builder
@@ -35,6 +37,8 @@ public class ShopifyStore {
 
     private String accessToken;
 
+    private String tokenSecret;
+
     private String scope;
 
     private int status;
@@ -48,8 +52,18 @@ public class ShopifyStore {
                 .createTime(new Date())
                 .creator("shopify store")
                 .accessToken(accessToken.getAccess_token())
+                .tokenSecret(accessToken.getSecret())
                 .scope(accessToken.getScope())
                 .modifyTime(new Date())
                 .status(1).build();
     }
+
+    public String storeName(){
+        Pattern pattern = Pattern.compile("(^[a-zA-Z0-9][a-zA-Z0-9\\-]*)\\.myshopify\\.com");
+        Matcher matcher = pattern.matcher(shopifyShop);
+        if (matcher.matches()){
+            return matcher.group(1);
+        }
+        return shopifyShop;
+    }
 }
diff --git a/src/test/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStoreTest.java b/src/test/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStoreTest.java
new file mode 100644
index 000000000..100441250
--- /dev/null
+++ b/src/test/java/au/com/royalpay/payment/manage/shopify/store/domain/entity/ShopifyStoreTest.java
@@ -0,0 +1,17 @@
+package au.com.royalpay.payment.manage.shopify.store.domain.entity;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class ShopifyStoreTest {
+
+    @Test
+    void storeName() {
+        ShopifyStore store = ShopifyStore.builder()
+                .shopifyShop("test-store-nicks-4.myshopify.com")
+                .build();
+        Assertions.assertEquals(store.storeName(), "test-store-nicks-4", "storename match");
+    }
+}
\ No newline at end of file