---
title: Restrict API access with an IP allowlist
description: >-
  Limit the IP addresses that can use your app's access tokens to make GraphQL
  Admin API and REST Admin API requests.
source_url:
  html: 'https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist'
  md: 'https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist.md'
---

# Restrict API access with an IP allowlist

An IP allowlist limits where your app's access tokens can be used. When enforcement is on, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request that uses your app's tokens. Requests from outside your allowed ranges fail with a `403` status code, and so do requests whose source address Shopify can't confirm. A stolen token can't make GraphQL or REST Admin API requests from anywhere but your own servers.

***

## Compatibility

An IP allowlist works for apps that call Shopify from static, public IP addresses. It doesn't work with the following:

* Apps on platforms that assign dynamic IP addresses, such as most serverless platforms.
* Access tokens used by the Shopify Flow [**Send HTTP request** action](https://help.shopify.com/en/manual/shopify-flow/reference/actions/send-http-request). Shopify can't confirm the source IP address of these requests, so it rejects them.
* Access tokens used to make GraphQL Admin API requests from a storefront hosted on [Oxygen](https://shopify.dev/docs/storefronts/hydrogen/deploy/oxygen), for the same reason.

**Note:**

Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.

These kinds of requests are never rejected:

* [Dev preview](https://shopify.dev/docs/apps/build/cli-for-apps/test-apps-locally) requests on dev stores.
* [Direct API access](https://shopify.dev/docs/api/app-home#direct-api-access) requests from your app's embedded pages.

***

## IP address rules

IP allowlists are written as CIDR ranges. A CIDR range is an IP address followed by a prefix length. For example, `203.0.113.0/24` covers `203.0.113.0` to `203.0.113.255`. A higher prefix length means a smaller range, and an entry without one is a single address. To convert an address range to CIDR ranges, use [ARIN's CIDR Calculator](https://www.arin.net/reference/tools/cidr/).

Your allowed IP addresses must follow these rules:

* Enter up to 100 addresses or ranges, one per line.
* Use `/16` or narrower for IPv4, and `/32` or narrower for IPv6.
* Use public addresses only. If your servers are behind a NAT gateway, then use the gateway's addresses.
* Start each range at its network address, such as `203.0.113.0/24`, not `203.0.113.7/24`.
* If your servers reach Shopify over IPv6, then include their IPv6 addresses.

***

## Set up an IP allowlist

1. Open your app in the [Dev Dashboard](https://dev.shopify.com/dashboard/), click **Settings**, and then click **Manage** in the **IP allowlist** section.

2. In **IP addresses or CIDR ranges**, enter your addresses and ranges.

3. Under **Test against recent traffic**, click **Run test**.

   * Check whether any of your own addresses from the last 30 days would be blocked. If they would, then adjust the ranges and test again.
   * Results can take a few minutes to include your most recent requests.

4. Turn on **Enforcement**, and click **Save**.

5. Make a GraphQL Admin API request from outside your allowed ranges, and confirm that it fails with a `403` status code.

To stop enforcing the allowlist, turn off **Enforcement** and click **Save**. Shopify keeps your addresses, so you can turn enforcement back on later.

***

## Next steps

* [Review your app's API logs](https://shopify.dev/docs/apps/build/security/monitoring-and-response/review-your-apps-api-logs) on a schedule to catch requests from addresses you don't expect.
* Pair the allowlist with [expiring offline access tokens](https://shopify.dev/docs/apps/build/security/credentials-and-data/use-expiring-offline-access-tokens), which limit how long a leaked token works.

***