Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Friday 6 November
Global

Your region, kept on this device.

DonateGet the appSign in

Shopify Admin API

Product

Am I affected?

Checked against NVD affected-version data on our server. Nothing you type is stored.

Security timeline

  1. Advisory or policy news by Cyber Security NewsShopify makes IP allowlisting mandatory for public apps calling its Admin API

Recent news

Cyber Security News·

Shopify makes IP allowlisting mandatory for public apps calling its Admin API

is turning IP allowlisting for public apps calling the into a requirement, so requests must come from approved IP addresses, ranges or hosting networks as well as carry a valid token. Developers must enable the control by 20 November 2026 at 11:59 PM ET, or by 12 November 2026 for apps using bulk operations, and apps that miss the deadline face removal from the App Store. Shopify also requires public apps to move to expiring offline tokens by 1 January 2027.

Am I affected?
Ask
1

Last updated 6 November 2026. Facts come from our own stories, NVD and CISA KEV, MITRE ATT&CK and Wikidata, each named beside the fact; the introduction, when there is one, is from Wikipedia. We never show company logos.

Report a mistake