Shopify makes IP allowlisting mandatory for public apps calling its Admin API
POLICYShopifyredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Shopify is turning IP allowlisting for public apps calling the Shopify Admin API into a requirement, so requests must come from approved IP addresses, ranges or hosting networks as well as carry a valid token. Developers must enable the control by 20 November 2026 at 11:59 PM ET, or by 12 November 2026 for apps using bulk operations, and apps that miss the deadline face removal from the App Store. Shopify also requires public apps to move to expiring offline tokens by 1 January 2027.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Test the allowlist against recent traffic to confirm legitimate requests are not blocked before turning on enforcement.
- Choose either IP addresses or networks for the allowlist, since saving one type replaces the other.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies
Products