Your app's IP allowlist in the Dev Dashboard can now include IP addresses and autonomous system numbers (ASNs) in the same allowlist. This helps apps whose requests come from a mix of static and dynamic IP addresses. You can also now configure up to 250 IP addresses or ranges, up from 100.
What changed
The IP allowlist section of your app's Settings page no longer makes you choose between IP addresses and networks. You can enter up to 250 addresses or ranges in IP addresses or CIDR ranges, up to 10 ASNs in Networks (ASN), or both. Under Limit ASNs to countries, you can choose up to 10 countries. Countries limit only your ASNs, not your IP addresses.
Requests are allowed if they match one of your configured IPs or ASNs. Requests from outside your allowlist fail with a 403 status code.
What to do
IP allowlists will soon be required for all public and custom apps. Shopify strongly recommends all apps use an IP allowlist.
Allow specific IP addresses wherever you can. This is the most secure option, because only your own servers can use your app's access tokens. An ASN allows every address on your hosting provider's network, including addresses used by the provider's other customers. Add ASNs only for requests that come from dynamic addresses, such as serverless functions, and limit them to the countries your app runs in.
Before you turn on enforcement, test your updated allowlist against recent traffic.
For setup instructions, see Restrict API access with an IP allowlist.