Shopify requires IP allowlists for public apps by November 20

Shopify says the vast majority of apps that run bulk operations have now adopted an IP allowlist. The company credits app developers with the progress and says it is a major step toward protecting merchants heading into the busiest weeks of the year.

The next deadline is firm. All public apps that call the Admin API must turn on an IP allowlist by November 20, 2026, at 11:59 PM ET. Apps without one will be delisted from the Shopify App Store and blocked from new installs. Existing installs keep working, and delisted apps will be relisted automatically once they add an allowlist.

Shopify is also beginning enforcement on bulk queries and mutations from public apps without an allowlist. Partner-created apps must be enabled for bulk operations through API access requests in the Partner Dashboard, and apps that go 31 days without a bulk query or mutation must be enabled again. Custom apps installed outside an organization also need an allowlist, starting with new installs on November 20, 2026, and existing installs on January 1, 2027. Apps installed only within an organization and apps created by merchants are not affected.

Allowlists can now combine IP addresses, CIDR ranges and hosting provider ASNs, up to 250 entries in total. A request is allowed if it matches any entry, and country restrictions apply only to ASNs.

Why it matters

Apps that miss the deadline lose their place in the App Store and cannot win new installs, which can hurt developers’ revenue. Custom app rules are stricter from January 1, when one app without an allowlist can block a merchant’s other apps from installing on outside stores. The changes also tighten security during peak sales periods.

What to do

Public app developers should turn on an IP allowlist well before November 20, using specific IP addresses where possible for the strongest protection. Partner account holders should set up multi-factor authentication before it becomes mandatory next week, with passkeys recommended. Readers should confirm exact enforcement details on Shopify’s changelog.