---
title: Restrict API access to your IP addresses
description: >-
  Allowlist your servers' IP addresses, so that a stolen access token can't make
  GraphQL or REST Admin API requests from anywhere else.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/restrict-api-access-to-your-ip-addresses
  md: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/restrict-api-access-to-your-ip-addresses.md
---

# Restrict API access to your IP addresses

Allowlist your servers' IP addresses, so that a stolen access token can't make GraphQL or REST Admin API requests from anywhere else.

***

## Why

An access token that leaks through a log, a bundle, or a compromised dependency works from any machine that holds it. With an IP allowlist, Shopify rejects GraphQL Admin API and REST Admin API requests that use your app's tokens from outside your ranges with a `403` status code, so the token can't call those APIs from anywhere but your own infrastructure.

[Expiring tokens](https://shopify.dev/docs/apps/build/security/credentials-and-data/use-expiring-offline-access-tokens) limit how long a leaked token works. An allowlist limits where. Use both.

***

## How

Your app must call Shopify from static, public IP addresses. To get started, see [Restrict API access with an IP allowlist](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist).

***

## Verify

Make a GraphQL Admin API request with one of your app's tokens from outside your allowed ranges, and confirm that it fails with a `403` status code. Then alert on `403` responses from your own servers, which mean an address you forgot to list.

***