Shopify

Shopify makes IP allowlisting mandatory for public apps calling its Admin API

Shopify◼ is turning IP allowlisting for public apps calling the Shopify Admin API◆ into a requirement, so requests must come from approved IP addresses, ranges or hosting networks as well as carry a valid token. Developers must enable the control by 20 November 2026 at 11:59 PM ET, or by 12 November 2026 for apps using bulk operations, and apps that miss the deadline face removal from the App Store. Shopify also requires public apps to move to expiring offline tokens by 1 January 2027.