Shopify is tightening the security around public apps that access the Admin API. Starting in November 2026, an IP allowlist will be mandatory for every public app, and for apps that use bulk operations the deadline is even earlier. This change protects merchants by ensuring that a leaked access token can only be used from the IP addresses or networks you explicitly approve.
What’s Changing?
Previously, the IP allowlist was a recommended best practice. As of the latest Developer Changelog, it is now a required setting for all public apps that call the Admin API. When enabled, Shopify will reject any request that originates from an IP address not on your list, preventing attackers from abusing a stolen token.
Who Must Comply?
The requirement applies to:
• All public apps that make Admin API calls (REST or GraphQL).
• Apps that perform bulk queries or mutations (these have an earlier cutoff).
Merchants are not directly responsible for the change, but they will see a warning in their Shopify admin (Settings > Apps) if an installed app lacks an allowlist after the deadline.
Key Dates to Remember
• November 20, 2026 – 11:59 PM ET: General public‑app deadline.
• November 12, 2026 – 11:59 PM ET: Bulk‑operations deadline (earlier because bulk jobs often run during peak shopping weeks).
• April 1, 2027: Existing installations that missed the deadline will stop working unless the allowlist is added before this final cut‑off.
How to Enable the IP Allowlist
{
"ip_allowlist": [
"203.0.113.0/24",
"198.51.100.12"
]
}
Special Considerations for Serverless & Dynamic IPs
If your app runs on serverless platforms (AWS Lambda, Cloudflare Workers, Vercel, etc.) you may not have fixed IPs. In that case, use ASN (Autonomous System Number) allowlisting instead of individual IPs. The Partner Dashboard now accepts ASN entries—just enter the number that represents your provider’s network.
Impact on Bulk Operations
Bulk queries and mutations use a separate set of API endpoints that will be blocked for any public app without an allowlist after November 12. If you already run bulk jobs, add the allowlist now to avoid disruptions during peak sales periods.
Testing & CI/CD Integration
Shopify introduced a network_access declaration that you can test in a dev‑store preview. The preview will flag any outbound request to a domain or IP you haven’t listed. Incorporate this check into your CI pipeline using the new tutorial (search “Shopify app security checks CI”). This catches missing entries before they reach production.
What Happens If You Miss the Deadline?
Shopify will start rejecting API calls from apps that lack an allowlist. Existing installations will continue to function only until April 1, 2027, after which they’ll be disabled. Merchants will see a warning badge on the app listing, prompting them to contact the app developer for an update.
Conclusion & Next Steps
The new IP allowlist requirement is a straightforward but critical security upgrade. Add your server IPs or ASN ranges today, test the network_access declaration in a dev store, and push the changes through your CI/CD pipeline. Doing so will keep your app functional, protect merchants from token leakage, and demonstrate that you’re on top of Shopify’s security standards.
Ready to get started? Log into your Partner Dashboard now, enable the IP allowlist, and schedule a quick QA run before the November deadline.
