Shopify now requires IP allowlists for public apps

Shopify is requiring every public app to configure an IP allowlist, according to a release note published on November 5, 2026. The allowlist limits the networks from which an app can call the Admin API, so a leaked token cannot be used from anywhere on the internet.

Deadlines depend on how an app uses Shopify. Public apps that run bulk operations must configure an allowlist by November 12, 2026. All other public apps have until November 20, 2026. If an app misses the first deadline, its bulk operations will fail to execute at 11:59 PM ET that day. If it misses the second, it will be delisted from the Shopify App Store and blocked from new installs at 11:59 PM ET.

Custom apps are not affected. Neither are apps that merchants create in the Dev Dashboard or in the admin.

Why it matters

Leaked Admin API tokens can currently be used from any network location. Requiring allowlists narrows that exposure and gives merchants stronger protection. Developers who miss the deadlines lose bulk operations or App Store visibility, so the change has direct revenue and operational consequences.

What to do

Public app developers should configure allowed IPs in the Dev Dashboard. Apps with static egress addresses can list those IPs or a CIDR range. Apps with dynamic addresses should allow their hosting provider’s ASNs and list the countries where the app runs. Developers that call the Admin API from merchant infrastructure should move to an architecture that limits token exposure as quickly as possible. Shopify says a request for an extension to the deadlines can be submitted, and setup details are in the company’s guide to restricting API access with an IP allowlist.