Shopify Mandates IP Allowlisting for All Public Apps
Original title: Shopify Makes IP Allowlisting Mandatory for All Public Apps to Prevent Stolen API Token Abuse
Public apps must enable IP allowlisting by November 12, 2026 or face delisting from the Shopify App Store after November 20.
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen API access tokens. Announced November 5, 2026, restrictions start November 12 for bulk operations at 11:59 PM ET. Non-compliant apps face delisting, blocking from new installs, and merchant warnings from January 2027. Requests outside approved networks receive HTTP 403 responses. Developers must configure rules in the Dev Dashboard and test against recent traffic.
- Bulk operations must enable allowlisting by November 12, 2026
- Apps without allowlists delisted after November 20
- Static deployments allow up to 100 IP addresses or CIDR ranges
- ASN approval limits to 10 networks with hosting tradeoffs
- Custom apps not required but recommended
Impact: reduced abuse of stolen API tokens
| Product | Affected |
|---|---|
| Shopify Admin API | — |
- 1.Enable IP allowlisting in Dev Dashboard
- 2.Specify approved IP addresses or networks
- 3.Test allowlisting rules against recent traffic
- Vendors
- Shopify
From the original article
2 min read at gbhackers.com
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen API access tokens. Shopify announced this requirement on November 5, 2026, and set enforcement deadlines right before merchants’ busiest shopping weeks, with restrictions starting on November 12 for applications using bulk operations. Developers must now specify which public IP addresses, […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.