---
title: IP allowlists are now required for public apps - Shopify developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/posts/ip-allowlists-are-now-required-for-public-apps
  md: >-
    https://shopify.dev/changelog/posts/ip-allowlists-are-now-required-for-public-apps.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: Platform
    handle: platform
  secondaryTag:
    displayName: Update
    handle: update
  indicatesActionRequired: true
  createdAt: '2026-11-04T01:32:52-05:00'
  postedAt: '2026-11-05T10:59:00-05:00'
  updatedAt: '2026-11-05T10:43:00-05:00'
  effectiveAt: '2026-11-05T13:00:00-05:00'
---

November 5, 2026

# IP allowlists are now required for public apps

DateNovember 5, 2026

FlagsUpdate[Action required](https://shopify.dev/changelog?action_required=true)

Tags[Security](https://shopify.dev/changelog?filter=security)Platform

We're enhancing protection of merchants by adding IP allowlist configuration as a requirement for public apps. All public apps using bulk operations must configure an allowlist by **November 12, 2026**, and all other public apps must configure an allowlist by **November 20, 2026**.

If an app is not migrated by these dates:

* **November 12, 2026 at 11:59 PM ET.:** Bulk operations from public apps without an IP allowlist will fail to execute.
* **November 20, 2026 at 11:59 PM ET:** Public apps without an IP allowlist will be delisted from the Shopify App Store and blocked from new installs.

## What apps are affected

All [public apps](https://shopify.dev/docs/apps/launch/distribution#capabilities-and-requirements).

## What apps are unaffected

* Custom apps
* Apps created by merchants either in the Dev Dashboard or in the admin

## Why we're making this change

Leaked tokens can be used from any network location. IP allowlists reduce the impact of a credential leak by limiting the networks from which your app can invoke the Admin API.

## What to do

Configure your app's allowed IPs in the Dev Dashboard:

* If your app calls Shopify from static IP addresses, configure your IP allowlist based on static IPs or CIDR range.
* If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in.

For setup instructions, see [Restrict API access with an IP allowlist](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist).

### What if my app makes Admin API calls from merchant infrastructure?

You should move as quickly as possible to an architecture that better limits exposure of Admin API tokens. You may [submit a request](https://forms.gle/T2grcY2EK3vtCf3F7) for an extension to the deadlines above.