---
title: >-
  App IP allowlists now support IP addresses and ASNs together, and up to 250
  IPs - Shopify developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/posts/app-ip-allowlists-now-support-ip-addresses-and-asns-together
  md: >-
    https://shopify.dev/changelog/posts/app-ip-allowlists-now-support-ip-addresses-and-asns-together.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: Dev Dashboard
    handle: dev-dashboard
  secondaryTag:
    displayName: Update
    handle: update
  indicatesActionRequired: false
  createdAt: '2026-11-11T14:58:57-05:00'
  postedAt: '2026-11-11T17:00:00-05:00'
  updatedAt: '2026-11-11T15:26:53-05:00'
  effectiveAt: '2026-11-12T12:00:00-05:00'
---

November 11, 2026

# App IP allowlists now support IP addresses and ASNs together, and up to 250 IPs

DateNovember 11, 2026

FlagsUpdate

Tags[Security](https://shopify.dev/changelog?filter=security)Dev Dashboard

Your app's IP allowlist in the Dev Dashboard can now include IP addresses and autonomous system numbers (ASNs) in the same allowlist. This helps apps whose requests come from a mix of static and dynamic IP addresses. You can also now configure up to 250 IP addresses or ranges, up from 100.

## What changed

The IP allowlist section of your app's Settings page no longer makes you choose between IP addresses and networks. You can enter up to 250 addresses or ranges in **IP addresses or CIDR ranges**, up to 10 ASNs in **Networks (ASN)**, or both. Under **Limit ASNs to countries**, you can choose up to 10 countries. Countries limit only your ASNs, not your IP addresses.

Requests are allowed if they match one of your configured IPs or ASNs. Requests from outside your allowlist fail with a `403` status code.

## What to do

IP allowlists will soon be required for all [public](https://shopify.dev/changelog/posts/ip-allowlists-are-now-required-for-public-apps) and [custom](https://shopify.dev/changelog/posts/ip-allowlists-are-now-required-for-custom-apps-installed-outside-your-organization) apps. Shopify strongly recommends all apps use an IP allowlist.

Allow specific IP addresses wherever you can. This is the most secure option, because only your own servers can use your app's access tokens. An ASN allows every address on your hosting provider's network, including addresses used by the provider's other customers. Add ASNs only for requests that come from dynamic addresses, such as serverless functions, and limit them to the countries your app runs in.

Before you turn on enforcement, test your updated allowlist against recent traffic.

For setup instructions, see [Restrict API access with an IP allowlist](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist).