---
title: Restrict Admin API access with an IP allowlist - Shopify developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/posts/restrict-admin-api-access-to-your-app-with-an-ip-allowlist
  md: >-
    https://shopify.dev/changelog/posts/restrict-admin-api-access-to-your-app-with-an-ip-allowlist.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: Dev Dashboard
    handle: dev-dashboard
  secondaryTag:
    displayName: New
    handle: new
  indicatesActionRequired: false
  createdAt: '2026-10-26T23:53:07-04:00'
  postedAt: '2026-10-27T12:00:00-04:00'
  updatedAt: '2026-10-27T12:20:42-04:00'
  effectiveAt: '2026-10-27T12:00:00-04:00'
---

October 27, 2026

# Restrict Admin API access with an IP allowlist

DateOctober 27, 2026

FlagsNew

SurfacesDev Dashboard

You can now limit Admin API access tokens by IP address. When you add your servers' IP addresses to an IP allowlist in the Dev Dashboard, Shopify rejects [GraphQL Admin API](https://shopify.dev/docs/api/admin-graphql/latest) and [REST Admin API](https://shopify.dev/docs/api/admin-rest) requests that use your app's tokens from anywhere else.

## What changed

Your app's **Settings** page has a new **IP allowlist** section. Enter your servers' addresses or CIDR ranges, test them against recent traffic, and enable enforcement. Requests from outside your ranges fail with a `403` status code.

## What to do

We strongly recommend using an IP allowlist if your app calls Shopify from static IP addresses. For setup instructions, see [Restrict API access with an IP allowlist](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist).

***

**Note:** Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.

***