Shopify is making IP allowlists mandatory for public apps that call its Admin API, requiring developers to restrict where their app access tokens can be used. The company announced the change on November 5, making mandatory a control it had recommended on October 27.
Apps that use bulk operations must enable an allowlist by November 12, 2026, at 11:59 p.m. Eastern Time. After that deadline, bulk queries and mutations from public apps without an allowlist will be blocked. Other public apps have until November 20, 2026, at 11:59 p.m. ET. Apps that miss that deadline will be delisted from the Shopify App Store and blocked from new installations. Shopify says existing installations will continue working until April 1, 2027, when Admin API requests from apps without an allowlist will fail. The summary at the top of Shopify’s accompanying blog post says November 11 for bulk operations, but its detailed instructions and the separate developer changelog both specify November 12.
With enforcement enabled, Shopify checks the source address for every GraphQL Admin API and REST Admin API request that uses an app’s token. Requests from outside the approved IP addresses or networks are rejected with an HTTP 403 response. Shopify also added support for hosting-provider autonomous system numbers, or ASNs, so apps running on serverless platforms or using dynamic outbound addresses can restrict access by network and country. Its IP allowlist documentation says developers can configure up to 10 ASNs and up to 10 countries. Shopify also cautions that an allowed ASN is a shared network, so another customer on that provider could use a stolen token from the same network.
The requirement applies to public apps. Custom apps and apps created by merchants through the Dev Dashboard or Shopify admin are excluded. Apps that make Admin API requests from merchant infrastructure can request an extension, according to Shopify’s November 5 security update. The company says the control is intended to reduce the value of leaked tokens by preventing them from being used from arbitrary network locations, a concern that also surfaced in an earlier exposure of hardcoded Shopify API keys in Android apps and the Chainalysis breach that exposed live access tokens.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
