Shopify’s latest developer update gives you granular control over every external request your app makes. By adding a new network_access section to shopify.app.toml, you can whitelist navigation hosts and data sources, removing the dreaded “You’re leaving Shopify” warning for shoppers and giving Shopify the information it needs to guard against malicious traffic. In this post we’ll break down exactly what changed, who needs to act, and step‑by‑step instructions to get your app compliant and frictionless.
What Changed: Network Access Rules in shopify.app.toml
The new network_access section adds two properties to your app’s TOML configuration:
• allowed_navigation_hosts — a list (max 20) of exact hostnames that your app links to from the storefront or checkout. When a shopper clicks a link that points to one of these hosts, Shopify skips the external‑link warning, creating a smoother checkout flow.
• allowed_sources — up to 20 HTTPS origins that your app’s JavaScript, Liquid, or proxy code loads resources from or sends requests to on storefront, checkout, or the admin. Shopify uses this list to monitor for suspicious activity and to protect your app and merchants from cross‑site attacks.
Both arrays accept plain strings. Hosts must be written exactly as they appear in your links (e.g., app.example.com without protocol). Sources must include the full scheme (e.g., https://api.app.example.com).
Here’s a minimal example that you can paste directly into your shopify.app.toml:
[network_access]
allowed_navigation_hosts = ["app.example.com"]
allowed_sources = ["https://api.app.example.com"]
Who Is Affected
Any public or private app that embeds links, iframes, scripts, or API calls pointing outside Shopify’s domain is impacted. That includes:
• Embedded app home pages that redirect users to your SaaS dashboard.
• Checkout extensions that fetch pricing data or shipping estimates from an external service.
• Admin extensions, app proxies, or custom storefront scripts that call your backend APIs or CDN assets.
If you don’t declare these endpoints, Shopify will continue to show the external‑link warning and may flag suspicious traffic, which could lead to temporary throttling or app review delays.
How to Implement the New network_access Section
• allowed_navigation_hosts – every domain a shopper can be sent to via a link or button.
• allowed_sources – every origin your JavaScript loads from or posts data to (including APIs, CDNs, analytics providers, etc.).
Testing and Deployment Checklist
Conclusion & Next Steps
By declaring your app’s external hosts in shopify.app.toml, you not only eliminate friction for shoppers but also give Shopify the data it needs to keep your app safe. The change is straightforward—just audit, list, and deploy—and the payoff is an app that feels native, secure, and trustworthy. Need help updating your TOML file or testing the new settings? Drop a comment below or reach out to our Shopify expert team for a quick walkthrough.
