Restrict API access to your IP addresses

Install AI ToolkitAsk about this pageCopy MD

Allowlist your servers' IP addresses, so that a stolen access token can't make GraphQL or REST Admin API requests from anywhere else.

---

Anchor to WhyWhy

An access token that leaks through a log, a bundle, or a compromised dependency works from any machine that holds it. With an IP allowlist, Shopify rejects GraphQL Admin API and REST Admin API requests that use your app's tokens from outside your ranges with a 403 status code, so the token can't call those APIs from anywhere but your own infrastructure.

Expiring tokens limit how long a leaked token works. An allowlist limits where. Use both.

---

Anchor to HowHow

Your app must call Shopify from static, public IP addresses. To get started, see Restrict API access with an IP allowlist.

---

Anchor to VerifyVerify

Make a GraphQL Admin API request with one of your app's tokens from outside your allowed ranges, and confirm that it fails with a 403 status code. Then alert on 403 responses from your own servers, which mean an address you forgot to list.

---