Skip to main content

Restrict API access with an IP allowlist

An IP allowlist limits where your app's access tokens can be used. When enforcement is on, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request that uses your app's tokens. Requests from outside your allowed ranges fail with a 403 status code, and so do requests whose source address Shopify can't confirm. A stolen token can't make GraphQL or REST Admin API requests from anywhere but your own servers.

Anchor to CompatibilityCompatibility

An IP allowlist works for apps that call Shopify from static, public IP addresses. It doesn't work with the following:

  • Apps on platforms that assign dynamic IP addresses, such as most serverless platforms.
  • Access tokens used by the Shopify Flow Send HTTP request action. Shopify can't confirm the source IP address of these requests, so it rejects them.
  • Access tokens used to make GraphQL Admin API requests from a storefront hosted on Oxygen, for the same reason.
Note

Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.

These kinds of requests are never rejected:

Anchor to IP address rulesIP address rules

IP allowlists are written as CIDR ranges. A CIDR range is an IP address followed by a prefix length. For example, 203.0.113.0/24 covers 203.0.113.0 to 203.0.113.255. A higher prefix length means a smaller range, and an entry without one is a single address. To convert an address range to CIDR ranges, use ARIN's CIDR Calculator.

Your allowed IP addresses must follow these rules:

  • Enter up to 100 addresses or ranges, one per line.
  • Use /16 or narrower for IPv4, and /32 or narrower for IPv6.
  • Use public addresses only. If your servers are behind a NAT gateway, then use the gateway's addresses.
  • Start each range at its network address, such as 203.0.113.0/24, not 203.0.113.7/24.
  • If your servers reach Shopify over IPv6, then include their IPv6 addresses.

Anchor to Set up an IP allowlistSet up an IP allowlist

  1. Open your app in the Dev Dashboard, click Settings, and then click Manage in the IP allowlist section.
  2. In IP addresses or CIDR ranges, enter your addresses and ranges.
  3. Under Test against recent traffic, click Run test.
    • Check whether any of your own addresses from the last 30 days would be blocked. If they would, then adjust the ranges and test again.
    • Results can take a few minutes to include your most recent requests.
  4. Turn on Enforcement, and click Save.
  5. Make a GraphQL Admin API request from outside your allowed ranges, and confirm that it fails with a 403 status code.

To stop enforcing the allowlist, turn off Enforcement and click Save. Shopify keeps your addresses, so you can turn enforcement back on later.

Anchor to Next stepsNext steps

Was this page helpful?