Shopify is tightening security for merchants by making IP allowlists a mandatory configuration for every public app. If you develop or maintain a public app, you have a clear deadline to protect your customers and avoid app delisting. This post breaks down the change, who it impacts, why it matters, and exactly how to get your app compliant before the November 2026 cut‑off.
What’s Changing? IP Allowlist Requirement for Public Apps
Effective November 12, 2026, any public app that uses Shopify’s Bulk Operations API must have an IP allowlist configured, or its bulk jobs will fail. A broader deadline of November 20, 2026 applies to all other public apps – after that date, apps without an allowlist will be removed from the App Store and blocked from new installations.
Who Is Affected?
All public apps listed on the Shopify App Store are in scope, regardless of size or functionality. Custom apps—those built by merchants for their own stores or created directly in the Dev Dashboard—are exempt. In short, if your app is distributed to multiple merchants via the App Store, you must comply.
Key Deadlines You Must Meet
• November 12, 2026, 11:59 PM ET – Bulk‑operation public apps without an allowlist will see their jobs fail.
• November 20, 2026, 11:59 PM ET – All other public apps without an allowlist will be delisted and blocked from new installs.
If you miss these dates, your app’s functionality will be severely limited, and you’ll need to go through a re‑approval process to get back on the store.
Why Shopify Is Enforcing IP Allowlists
Leaked API tokens are a real risk. Without an IP restriction, a stolen token can be used from any network, giving a malicious actor full admin access to a merchant’s store. By limiting the source IPs or network ranges that can call the Admin API, Shopify reduces the blast radius of any credential compromise and adds a strong, zero‑trust layer to app security.
How to Configure an IP Allowlist in the Dev Dashboard
• Static IPs – Add each public IPv4 address or CIDR block.
• Dynamic IPs – Add the Autonomous System Numbers (ASNs) of your cloud provider and optionally limit by country.
{
"ip_allowlist": ["203.0.113.0/24", "198.51.100.23"]
}
If you run on a platform with rotating egress IPs (e.g., serverless functions), you can whitelist the provider’s ASN and restrict by country:
{
"ip_allowlist_asns": ["AS16509"],
"allowed_countries": ["US", "CA"]
}
What If My App Calls the Admin API from Merchant Infrastructure?
Shopify strongly recommends moving away from any architecture that exposes admin tokens on merchant‑controlled networks. If you cannot migrate immediately, you can request an extension through the Partner Support portal, but the request must be justified with a detailed migration plan.
Next Steps and Checklist
Conclusion
IP allowlists are a simple yet powerful way to safeguard merchant data and keep your public app alive on the Shopify App Store. By acting now, you avoid service interruptions, protect against token leakage, and demonstrate a commitment to security that merchants value. Need help updating your app’s configuration? Reach out to Shopify Partner Support or drop a comment below – we’re happy to walk you through the process.
