On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can't be used anywhere but your own servers. With the busiest weeks of the year for merchants almost here, we're asking for it now.
Action required
All public apps that call the Admin API: Turn on the IP allowlist by November 20, 2026 at 11:59 PM ET. With it on, your tokens only work from the addresses or networks you list, so a leaked token can't be used anywhere else. The IP allowlist is required for public apps. If you're on serverless or dynamic IPs, you'll need to allowlist by network with ASN support instead.
Bulk operations: Turn on the IP allowlist by November 12, 2026 at 11:59 PM ET. After that date, bulk queries and mutations from public apps without an IP allowlist are blocked.
Also this week
- Merchants can now see your app's security setup in Settings > Apps: expiring tokens and IP allowlist. After November 20, apps without an IP allowlist are flagged.
- Find non-expiring tokens fast: filter your Dev Dashboard API logs by token type. And our Token Expiry FAQ answers the most common questions.
- Network access testing in dev store previews: You can now test your
declarations before you release. It flags any site or server your app uses that you haven't declared yet. Test network access in dev store previews - Run app security checks in CI/CD. A new tutorial walks you through how to automatically scan your app for security issues.
- Coming soon, access scopes for bulk operations: Bulk queries and bulk mutations will each need their own scope. If your app ran a bulk operation in the last 180 days, Shopify grants the scopes automatically. Once they're live, add them to your app config before your next deploy. We'll share the changelog with the scope names when ready.
If you miss a deadline
To protect merchant security, we'll begin enforcing IP allowlists starting in November. The timelines for expiring offline access tokens remain the same. In both cases, existing installs keep working until April 1, 2027:
| IP allowlist | Expiring offline access tokens | |
|---|---|---|
| Bulk queries and mutations blocked | November 12, 2026 | |
| Delisted from the App Store, no new installs | November 20, 2026 | January 1, 2027 |
| Flagged in merchant Settings > Apps | November 20, 2026 | January 1, 2027 |
| Merchants see a warning in their admin | January 15, 2027 | January 15, 2027 |
| Admin API requests fail | April 1, 2027 | April 1, 2027 |
Get help
If you see something suspicious, tell us right away at partner-security-reports@shopify.com. You're responsible for fixing it and notifying affected merchants, and we'll support you through it.
For general security inquiries, contact Shopify Support.
Everything lives in the App Security Hub, and we answer questions on the App Security board in the developer community.