Shopify apps must enable IP allowlists by November 20

Shopify is requiring every public app that calls the Admin API to turn on an IP allowlist. The deadline for most public apps is November 20, 2026 at 11:59 PM ET. Apps that run bulk operations have an earlier deadline of November 12, 2026 at 11:59 PM ET. Shopify first recommended the allowlist on October 27.

An IP allowlist restricts where app tokens can be used. Once it is on, tokens work only from the addresses or networks the developer lists, so a leaked token cannot be used anywhere else. After November 12, bulk queries and mutations from public apps without an allowlist are blocked. After November 20, apps without one are flagged. Shopify says it will begin enforcing IP allowlists in November for apps that miss the deadlines.

Shopify also announced related changes this week. Merchants can now see an app’s security setup, including expiring tokens and IP allowlist status, under Settings > Apps. Developers can test network access declarations in dev store previews, which flag any site or server an app uses that has not been declared. A new tutorial explains how to run app security checks automatically in CI/CD pipelines. Separately, bulk queries and bulk mutations will each require their own access scope. Apps that ran a bulk operation in the last 180 days receive those scopes automatically, and the scope names will be published in a changelog when ready.

Why it matters

The change arrives just before the busiest weeks of the year for merchants, and Shopify is asking developers to act now. A leaked token is a direct route into a merchant’s store, and the allowlist limits that risk to the developer’s own servers. Apps that miss the deadlines face blocked bulk operations or flags, which can disrupt merchant workflows.

What to do

Developers should turn on the IP allowlist before November 12 if their app runs bulk operations, and before November 20 otherwise. Apps on serverless or dynamic IP addresses should allowlist by network using ASN support instead. Developers can also filter Dev Dashboard API logs by token type to find non-expiring tokens, and should confirm the remaining details in Shopify’s release notes and Token Expiry FAQ.