Shopify now requires IP allowlists for custom apps on outside stores

Shopify is requiring IP allowlists for custom apps installed on stores outside the organization that owns them. New installs must have an allowlist starting November 20, 2026 at 11:59 PM ET. Existing installs must comply starting January 1, 2027 at 11:59 PM ET.

The rule covers only custom apps installed on outside stores. Apps installed solely on stores within the owning organization are unaffected. Apps created by merchants in the Dev Dashboard or in the admin as public apps are also excluded, because they fall under a separate requirement.

Partners who own multiple apps face the largest impact. From January 1, 2027, a single app without an allowlist will affect the ability to install any app on stores outside the organization.

Why it matters

Leaked access tokens can currently be used from any network location. An IP allowlist limits the networks from which an app can call the Admin API, which reduces the damage a credential leak can cause. Partners who miss the deadline could find their installs blocked across multiple apps.

What to do

Audit every custom app installed on stores outside your organization, and configure an allowlist on each one before January 1, 2027. Apps that call Shopify from static IP addresses can allowlist those addresses or a CIDR range, while apps with dynamic egress IPs should allow their hosting provider’s ASNs and list the countries they run in. Setup steps are in Shopify’s guide “Restrict API access with an IP allowlist,” and readers should confirm details on Shopify’s site before making changes.