Thanks to you, we've already seen the vast majority of apps that run bulk operations adopt an IP allowlist. That's a big step toward keeping merchants protected heading into the busiest weeks of the year.
Here's what's required, what's new, and what's coming next.
Anchor to Action requiredAction required
- All public apps that call the Admin API: Turn on an IP allowlist by November 20, 2026 at 11:59 PM ET. Apps without one will be delisted from the Shopify App Store and blocked from new installs. Existing installs keep working. For apps that are delisted, we'll relist apps automatically once they add an IP allowlist. Set up your IP allowlist
- Bulk operations: We're beginning enforcement on bulk queries and mutations from public apps without an IP allowlist. Turn on your allowlist to restore them.
- Enable bulk operations for partner-created apps: Before your app can run bulk queries or bulk mutations, enable them from API access requests in the Partner Dashboard. If your app doesn't start a bulk query or mutation for 31 days, you'll need to enable it again. Read the changelog
- Custom apps installed outside your organization also need an IP allowlist: These apps need an IP allowlist for new installs from November 20, 2026, and for existing installs from January 1, 2027. From January 1, one app without an allowlist blocks you from installing any of your apps on stores outside your organization. Apps installed only within your organization, and apps created by merchants, aren't affected. Read the changelog
Anchor to New this weekNew this week
- You can now use IP addresses and ASNs together. Your allowlist can include IP addresses, CIDR ranges and your hosting provider's ASNs at the same time, with up to 250 IP addresses or ranges. A request is allowed if it matches any entry. Country restrictions apply only to ASNs. For the strongest protection, use specific IP addresses wherever you can. Read the changelog
Anchor to Coming soonComing soon
- MFA on every partner account. Starting next week, multi-factor authentication will be required on all partner accounts. We recommend passkeys. Turn on MFA now so it doesn't interrupt your work later. Protect the accounts that control your app
Anchor to Get helpGet help
If you see something suspicious, tell us right away at partner-security-reports@shopify.com. You're responsible for fixing it and notifying affected merchants, and we'll support you through it.
For general security questions, contact Shopify Support.
Everything lives in the App Security Hub, and we answer questions on the App Security board in the developer community.
Was this page helpful?