---
title: Review your app's API logs
description: >-
  Review your app's API logs in the Dev Dashboard regularly, and look for
  requests that your infrastructure didn't send.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/review-your-apps-api-logs
  md: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/review-your-apps-api-logs.md
---

# Review your app's API logs

Review your app's [**Logs**](https://shopify.dev/docs/apps/build/dev-dashboard/monitoring-and-logs#logs) in the Dev Dashboard regularly, and look for requests that your infrastructure didn't send.

***

## Why

A leaked access token that's used to make requests shows up as API traffic from somewhere other than your servers. The logs cover the last 30 days and show the shop, client IP address, and user agent of each request made with your app's tokens.

Log review detects a stolen token. It doesn't detect an [unauthenticated endpoint](https://shopify.dev/docs/apps/build/security/backend/authenticate-every-request), because requests through one come from your own server with your own token.

***

## How

1. Open your app's **Logs** in the Dev Dashboard.
2. Filter GraphQL Admin API and REST Admin API requests by client IP address or user agent.
3. Compare the results with the addresses and agents your infrastructure uses.
4. If you find requests you can't account for, then follow the steps in [Respond to a security incident](https://shopify.dev/docs/apps/build/security/monitoring-and-response/respond-to-a-security-incident).

***

## Verify

No app security check covers this practice. Put the review on a recurring schedule, and alert on new client IP addresses if your logging pipeline allows it.

***