We're enhancing protection of merchants by adding IP allowlist configuration as a requirement for public apps. All public apps using bulk operations must configure an allowlist by November 12, 2026, and all other public apps must configure an allowlist by November 20, 2026.
If an app is not migrated by these dates:
- November 12, 2026 at 11:59 PM ET.: Bulk operations from public apps without an IP allowlist will fail to execute.
- November 20, 2026 at 11:59 PM ET: Public apps without an IP allowlist will be delisted from the Shopify App Store and blocked from new installs.
What apps are affected
All public apps.
What apps are unaffected
- Custom apps
- Apps created by merchants either in the Dev Dashboard or in the admin
Why we're making this change
Leaked tokens can be used from any network location. IP allowlists reduce the impact of a credential leak by limiting the networks from which your app can invoke the Admin API.
What to do
Configure your app's allowed IPs in the Dev Dashboard:
- If your app calls Shopify from static IP addresses, configure your IP allowlist based on static IPs or CIDR range.
- If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in.
For setup instructions, see Restrict API access with an IP allowlist.
What if my app makes Admin API calls from merchant infrastructure?
You should move as quickly as possible to an architecture that better limits exposure of Admin API tokens. You may submit a request for an extension to the deadlines above.