---
title: >-
  Secure your app with network access rules in shopify.app.toml - Shopify
  developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/posts/secure-your-app-with-network-access-hosts-in-shopify-app-toml
  md: >-
    https://shopify.dev/changelog/posts/secure-your-app-with-network-access-hosts-in-shopify-app-toml.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: Platform
    handle: platform
  secondaryTag:
    displayName: New
    handle: new
  indicatesActionRequired: false
  createdAt: '2026-10-27T00:02:07-04:00'
  postedAt: '2026-10-27T12:00:00-04:00'
  updatedAt: '2026-10-27T12:52:02-04:00'
  effectiveAt: '2026-10-27T12:00:00-04:00'
---

October 27, 2026

# Secure your app with network access rules in `shopify.app.toml`

DateOctober 27, 2026

FlagsNew

SurfacesPlatform

You can now declare your app's external hosts and servers in a new `[network_access]` section of `shopify.app.toml`. Normally Shopify warns customers when they navigate to a URL ouside Shopify; declaring your external hosts skips this warning, letting you remove friction for trusted journeys. Declaring servers, meanwhile, helps Shopify spot suspicious activity and protect your app.

## What changed

The new [`network_access`](https://shopify.dev/docs/apps/build/cli-for-apps/app-configuration#network_access) section has two properties:

* `allowed_navigation_hosts`: The external sites your app links to from the storefront, such as your own domain. Shopify normally warns customers before sending them to a site outside the storefront. Links to these hosts skip that warning. List each host exactly as it appears in your links, up to 20.
* `allowed_sources`: Up to 20 HTTPS origins that your app's code loads from or sends requests to on storefront, checkout, and Shopify admin pages. This includes your extensions, app home, and app proxy pages. We use the list to protect your app and monitor storefronts for malicious requests.

Here's an example configuration:

```toml
[network_access]
allowed_navigation_hosts = ["app.example.com"]
allowed_sources = ["https://api.app.example.com"]
```

## Who's affected

Any app whose code links to or contacts external servers from a storefront, checkout, or the Shopify admin can use the new section.

## What to do

For all apps, we strongly recommend you:

1. Add the hosts that your app links customers to, such as your app's own site, to `allowed_navigation_hosts`.
2. Add the servers that your app's code loads from or sends requests to, such as your API or CDN, to `allowed_sources`.
3. Run `shopify app deploy` and release the new version.

For examples, see [Declare your app's network access](https://shopify.dev/docs/apps/build/security/storefront/declare-network-access).