Apps without static IP addresses, such as apps on serverless platforms, can now add your hosting provider's autonomous system numbers (ASNs) to your app's IP allowlist in the Dev Dashboard.
What changed
The IP allowlist section of your app's Settings page now lets you allow either IP addresses or Networks (ASN). For networks, enter up to 10 ASNs and limit them to up to 10 countries. Test them against recent traffic, then turn on enforcement. Requests from outside your allowed networks fail with a 403 status code.
What to do
IP allowlists will soon be required for all public apps. Shopify strongly recommends all apps use an IP allowlist.
If your app calls Shopify from static IP addresses, keep allowing those addresses. If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in.
For setup instructions, see Restrict API access with an IP allowlist.