Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

Shopify Mandates IP Allowlisting for Public Apps by November 2026

2 sources · 2 articlesFirst reported Updated ()2
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Public apps must enable IP allowlisting by November 20, 2026 to block stolen Admin API token abuse, facing delisting otherwise.

Shopify requires all public apps accessing the Admin API to enable IP allowlisting and check request source IPs to prevent abuse of stolen tokens. The mandate takes effect November 20, 2026 for standard apps and November 12, 2026 for bulk operations, with full enforcement in April 2027. Non-compliant apps face delisting from the App Store, blocking from new installs, and merchant warnings from January 2027.

Key facts
  • IP allowlisting mandatory for public apps by November 20, 2026
  • Bulk operations deadline November 12, 2026
  • Unapproved IP requests receive HTTP 403
  • Configure up to 10 ASNs or 10 countries
  • Full enforcement April 2027
  • Static deployments allow up to 100 IP addresses or CIDR ranges
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026Shopify announces IP allowlisting requirement for public apps · GBHackers
  2. Nov 12, 2026Bulk operations must enable allowlisting · Both reports
  3. Nov 20, 2026Standard apps must enable IP allowlisting or face delisting · Both reports
  4. Jan 15, 2027Merchants start receiving warnings · Cyber Security News
  5. Apr 1, 2027Full enforcement and existing apps delisted · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsWarning start date January 15 and country/ASN limits up to 10
  • GBHackersStatic deployment IP limits up to 100 CIDR ranges and ASN hosting tradeoffs
Vendors
Shopify
Products
Admin APIGraphQL Admin APIREST Admin API

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Cyber Security NewsFirst report

    Shopify Mandates IP Allowlisting for Public Apps to Prevent Unauthorized Admin API Access

    Developers must enable IP allowlisting by November 20, 2026, or face App Store removal for public apps calling Admin API.

  2. · 5d ago GBHackers

    Shopify Mandates IP Allowlisting for All Public Apps

    Public apps must enable IP allowlisting by November 12, 2026 or face delisting from the Shopify App Store after November 20.