Shopify makes IP allowlisting mandatory for public apps calling its Admin API
- Severity
- Medium
- Sources
- 1
What happened
Shopify is making IP allowlisting mandatory for public apps using its GraphQL and REST Admin APIs, so that requests from outside approved IPs, ASNs (up to 10) or countries (up to 10) receive HTTP 403, and requests whose source cannot be confirmed are also rejected. Enforcement deadlines are 20 November 2026 at 11:59 PM ET for apps, and 12 November 2026 for bulk queries and mutations, with existing installations failing from 1 April 2027 and merchant warnings from 15 January 2027. Defenders should test allowlists against recent traffic before enforcement, choose either IP addresses or networks since saving one replaces the other, and migrate to expiring offline tokens by 1 January 2027. The article notes that an attacker inside an approved network would still pass the check, so credential protection remains necessary.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Test the allowlist against recent traffic to confirm legitimate requests are not blocked before turning on enforcement.
- Choose either IP addresses or networks for the allowlist, since saving one type replaces the other.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products