Shopify app IP allowlists now cover serverless hosting through ASNs

Shopify now lets apps without static IP addresses, such as apps on serverless platforms, add their hosting provider’s autonomous system numbers (ASNs) to an IP allowlist. The option is in the IP allowlist section of an app’s Settings page in the Dev Dashboard.

The section now lets developers allow either IP addresses or networks. For networks, developers can enter up to 10 ASNs and limit them to up to 10 countries. Shopify recommends testing the rules against recent traffic before turning on enforcement. Requests from outside the allowed networks fail with a 403 status code.

Why it matters

Shopify says IP allowlists will soon be required for all public apps, and it strongly recommends that every app use one. This change gives developers of apps without static IP addresses a supported way to meet that expectation. Without it, apps that cannot rely on fixed addresses would have a harder time restricting access.

What to do

If your app calls Shopify from static IP addresses, keep allowing those addresses. If your app’s egress IP addresses are dynamic, allow your hosting provider’s ASNs, list the countries your app runs in, and test the rules before enforcement. Confirm the setup steps in Shopify’s “Restrict API access with an IP allowlist” guide on the vendor’s site.