You can now limit Admin API access tokens by IP address. When you add your servers' IP addresses to an IP allowlist in the Dev Dashboard, Shopify rejects GraphQL Admin API and REST Admin API requests that use your app's tokens from anywhere else.
What changed
Your app's Settings page has a new IP allowlist section. Enter your servers' addresses or CIDR ranges, test them against recent traffic, and enable enforcement. Requests from outside your ranges fail with a 403 status code.
What to do
We strongly recommend using an IP allowlist if your app calls Shopify from static IP addresses. For setup instructions, see Restrict API access with an IP allowlist.
Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.
Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.
Note: Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.