# Shopify IP Allowlist Now Required for Public Apps: Deadlines and What to Do By [Eoin Villarin](https://amvprosox.com/about). Published 2026-11-07. Canonical: https://amvprosox.com/blog/shopify-ip-allowlist-required-public-apps > Shopify now requires an IP allowlist for every public app that calls the Admin API, with deadlines on November 12 and November 20, 2026. Here is what changes, what breaks if you miss it and how to prepare. ## When is the Shopify IP allowlist required? Shopify requires an IP allowlist for every public app that calls the Admin API by November 20, 2026, at 11:59 PM ET. Apps that use bulk operations must add one by November 12, 2026. Apps without one are delisted from the App Store on November 20, and their Admin API requests fail from April 1, 2027. **Key takeaways** - Every public app that calls the Shopify Admin API needs an IP allowlist by November 20, 2026. - Apps that use bulk operations have an earlier deadline of November 12, 2026, after which bulk queries and mutations are blocked. - Missing the deadline means App Store delisting, merchant warnings from January 15, 2027 and failed Admin API requests from April 1, 2027. - Apps on serverless hosting can allowlist a whole network by ASN instead of single IP addresses. - Separately, apps must move to expiring offline access tokens before January 1, 2027. Shopify now requires an IP allowlist for every public app that calls the Admin API. The main deadline is November 20, 2026, and apps that use bulk operations have only until November 12. If you build or run a Shopify app, or your store depends on one, this is what changes, what breaks if you miss it and how to get ready in time. ## What is a Shopify IP allowlist? An IP allowlist is a list of the IP addresses or networks your app's servers use. Once it is on, your app's access tokens only work when the request comes from one of those addresses. In Shopify's words, an IP allowlist means "a leaked token can't be used anywhere but your own servers." So if an access token ever leaks through a log file, a bug or a breach, an attacker cannot use it from their own machine. ## Which apps need an IP allowlist? Shopify's announcement applies to all public apps that call the Admin API. Shopify gives the reason plainly: merchants' busiest weeks of the year are almost here, and it wants leaked tokens to be useless before the holiday rush. The announcement does not say whether custom apps built for a single store are included. If you run a custom app, check your app's settings in the Dev Dashboard and Shopify's documentation, because adding an allowlist is a good idea either way. ## Shopify IP allowlist deadlines | Date (11:59 PM ET) | What happens | | --- | --- | | November 12, 2026 | Bulk queries and mutations from public apps without an IP allowlist are blocked. | | November 20, 2026 | Public apps without an IP allowlist are delisted from the App Store, so no new installs, and flagged in merchants' Settings > Apps. | | January 15, 2027 | Merchants see a warning in their Shopify admin. | | April 1, 2027 | Admin API requests from apps without an IP allowlist fail. | Existing installs keep working until April 1, 2027, but a delisted app with a warning in the admin is a hard sell to merchants, so the November dates are the ones that matter. ## How to prepare your app - **Map every place that calls the Admin API.** Include your main server, background workers, cron jobs, queues, webhook handlers and any scripts that run in CI. - **Find the outbound IP addresses.** Your hosting provider can tell you which addresses your servers use to make outgoing requests. If they change often, set up static outbound IPs. - **Use ASN allowlisting for serverless hosting.** Apps on serverless platforms or dynamic IPs can allowlist a whole network by its ASN instead of single addresses. Shopify added ASN support for exactly this case. - **Add the allowlist in the Dev Dashboard.** Shopify's Dev Dashboard lets you restrict Admin API access with an IP allowlist. - **Do bulk operations first.** If your app runs bulk queries or mutations, the earlier November 12 deadline applies. - **Test on a dev store.** Shopify's network access testing in dev store previews flags sites and servers your app talks to that you have not declared. - **Watch your API logs after the change.** A missed address shows up as failed requests, so check the logs before and after each deploy. A note from experience: allowlisting a whole cloud provider's network by ASN is better than nothing, but anyone renting a server from the same provider shares that network. For stricter security, send Admin API calls through one small proxy with a fixed IP address and allowlist only that address. ## The other deadline: expiring offline access tokens Shopify is also moving apps to expiring offline access tokens, with a separate timeline. Apps that still use non-expiring offline tokens are delisted and flagged in merchant settings on January 1, 2027, merchants see a warning from January 15, 2027, and requests fail from April 1, 2027. You can find non-expiring tokens by filtering your Dev Dashboard API logs by token type. Shopify has also said that bulk queries and mutations will each need their own access scope soon. Apps that ran a bulk operation in the last 180 days will receive those scopes automatically, but you should add them to your app config before your next deploy once they are live. ## What store owners should do - After November 20, open Settings > Apps in your Shopify admin and look for flagged apps. - Ask the developers of any flagged app when they will add an IP allowlist, especially for apps that handle orders, customers or inventory. - If you have a custom app built by a freelancer or agency, ask them to add an allowlist and check the token change too. If you need help securing a custom Shopify app or an integration before the deadlines, take a look at my [Shopify development](https://amvprosox.com/shopify-development) services or [contact me](https://amvprosox.com/#contact-form). ## Frequently asked questions ### When is the Shopify IP allowlist required? By November 20, 2026, at 11:59 PM ET for every public app that calls the Admin API, and by November 12, 2026, for apps that use bulk operations. ### What happens if my app misses the November 20 deadline? The app is delisted from the Shopify App Store, so it gets no new installs, and it is flagged in merchants' Settings > Apps. Merchants see a warning from January 15, 2027, and Admin API requests fail from April 1, 2027. ### Do existing merchants lose the app right away? No. Existing installs keep working until April 1, 2027, unless the app uses bulk operations, which are blocked after November 12, 2026. ### Does the requirement apply to custom apps? Shopify's announcement covers public apps that call the Admin API and does not say whether custom apps are included. Adding an allowlist to a custom app is still a good security step. ### My app runs on serverless hosting. How do I add an allowlist? Shopify supports allowlisting by ASN, which covers a whole hosting network instead of single IP addresses. For tighter control, route Admin API calls through a proxy with a fixed IP address. ### How do I report a leaked token or suspicious app activity? Shopify asks developers to report suspicious activity to partner-security-reports@shopify.com. App developers are responsible for fixing issues and notifying affected merchants. ## Sources - [Shopify: App security updates, IP allowlist is now required](https://shopify.dev/changelog/blog/app-security-updates-ip-allowlist-is-now-required) - [Shopify developer changelog](https://shopify.dev/changelog)