We're enhancing protection of merchants by requiring IP allowlists for custom apps, if those apps are installed on stores outside of the organization that owns them.
- Starting November 20, 2026 at 11:59 PM ET: Apps must have an IP allowlist for new installs.
- Starting January 1, 2027 at 11:59 PM ET: Allowlists are required for existing installs.
What apps are affected
- Custom apps installed on stores outside the organization that owns the app.
- Partners who own multiple apps. From January 1, 2027, one app without an allowlist affects your ability to install any app on stores outside your organization.
What apps are unaffected
- Apps installed only on stores within your own organization
- Apps created by merchants either in the Dev Dashboard or in the admin
- Public apps, which are covered by a separate requirement
Why we're making this change
Leaked tokens can be used from any network location. IP allowlists reduce the impact of a credential leak by limiting the networks from which your app can invoke the Admin API.
What to do
Configure your app's allowed IPs in the Dev Dashboard:
- If your app calls Shopify from static IP addresses, configure your IP allowlist based on static IPs or CIDR range.
- If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in.
Audit every app you've installed on stores outside your organization, and configure an allowlist on each one before January 1, 2027.
For setup instructions, see Restrict API access with an IP allowlist.
Was this page helpful?