Shopify Mandates IP Allowlisting for Public Apps to Prevent Unauthorized Admin API Access
Developers must enable IP allowlisting by November 20, 2026, or face App Store removal for public apps calling Admin API.
Shopify is enforcing IP allowlisting for public apps that access its Admin API, checking request source IPs to block unauthorized use of stolen tokens. The requirement takes effect November 20, 2026, for standard apps and November 12 for bulk operations, with full enforcement in April 2027. Merchants will get warnings starting January 15.
- IP allowlisting mandatory by November 20, 2026
- Bulk operations deadline November 12, 2026
- Requests from unapproved IPs get HTTP 403
- Apps can configure up to 10 ASNs or 10 countries
- Existing apps continue until April 1, 2027
From the original article
2 min read at cybersecuritynews.com
Shopify is making IP allowlisting mandatory for public apps that call its Admin API, adding a security check to limit the use of stolen access tokens. Developers must enable the control by November 20, 2026, at 11:59 PM ET. Apps using bulk operations face an earlier deadline of November 12 at the same time.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.