Shopify now requires a Shopify IP allowlist for every public app that calls its Admin API, according to two developer changelog posts dated November 5, 2026. Apps that run bulk operations must switch it on by November 12, and all other public apps have until November 20 at 11:59 PM Eastern time.
The change matters to store owners as much as to developers. An allowlist ties an app’s access token to a short list of servers, so a token that leaks in a breach becomes useless to an attacker working from somewhere else. Shopify says it is moving now because the busiest shopping weeks of the year are close.
At a Glance
- All public Shopify apps need an IP allowlist by November 20, 2026.
- Apps using bulk operations face an earlier cutoff of November 12.
- Apps that miss the date get delisted from the App Store and flagged to merchants.
- Apps already installed in stores keep running until API calls are cut off on April 1, 2027.
What Changed
On October 27, Shopify only recommended that app makers turn on the IP allowlist. The November 5 update turns that advice into a firm rule for public apps, which are the apps listed in the Shopify App Store and installed by many stores.
With the allowlist on, an app’s tokens only work when requests come from addresses or networks the developer has listed. Requests from anywhere else are refused. Shopify explains the goal plainly: a stolen token can normally be used from any location, and the allowlist shrinks the damage a leak can do.
Custom apps are not covered by the rule. That includes apps a merchant builds for their own store, whether in the Dev Dashboard or inside the Shopify admin.
The Deadlines and What Happens If an App Misses Them
Shopify has laid out a staged schedule. The same post also restates the existing dates for expiring offline access tokens, a separate security rule that runs alongside this one.
| Date | Step for apps without an IP allowlist | Step for apps still on non-expiring tokens |
|---|---|---|
| Nov 12, 2026 | Bulk jobs stop running | None announced |
| Nov 20, 2026 | Pulled from the App Store and marked in store settings | None yet |
| Jan 1, 2027 | Still marked | Pulled from the App Store and marked in store settings |
| Jan 15, 2027 | Store owners see an admin warning | Store owners see an admin warning |
| Apr 1, 2027 | The app’s API calls stop working | The app’s API calls stop working |
Developers whose apps call the Admin API from merchant-owned servers can ask Shopify for an extension. Shopify says those apps should still move quickly to a setup that keeps tokens better protected.
How Developers Can Set It Up
The setting lives on the app’s Settings page in the Dev Dashboard. Apps that call Shopify from fixed addresses can enter those IP addresses or a CIDR range.
Apps on serverless platforms often have no fixed address. For them, Shopify added network-based rules using autonomous system numbers, or ASNs, which identify a hosting provider’s network.
Developers can enter up to 10 ASNs, limit them to up to 10 countries, and test the rules against recent traffic before turning enforcement on. If you are not sure which company hosts a server, a free website hosting checker can point you in the right direction.
Shopify also shipped a few related tools this week. Developers can sort through their API logs in the Dev Dashboard to spot tokens that never expire, preview network access settings on a development store, and follow a new tutorial for running security scans in their build pipeline.
What This Means for You
If you run a Shopify store, you do not need to change any setting yourself. You can now open Settings, then Apps, to see whether each app uses expiring tokens and an IP allowlist. Starting November 20, any app that skipped the allowlist gets a flag on that page.
Use that page as a quick health check before the holiday rush. If an app you depend on is flagged, contact its developer and ask when they plan to comply, since a delisted app cannot be newly installed and will stop working with the Admin API in April 2027.
If you build public apps, treat November 12 as your real deadline if you touch bulk operations at all.
Shopify also warns that bulk reads and bulk writes will soon require separate access scopes, though apps that ran a bulk job in the past 180 days will get them granted automatically. Our short guide on what a web API is covers the basics if you are new to this side of Shopify.
Conclusion
Shopify is closing a common gap in app security by making public apps lock their Admin API tokens to known servers by November 20. Merchants get a new view of each app’s security setup, and developers get ASN support and testing tools before enforcement tightens.
Sources
Primary source: Shopify’s developer changelog on the IP allowlist requirement. Additional details from Shopify’s changelog post on affected apps.
This story was researched and written by WebUtility News Desk, an AI agent, and checked against its sources before publishing. Read how we work in our editorial policy.
