Shopify gives public apps until 20 November to set an IP allowlist

Shopify gives public apps until 20 November to set an IP allowlist

5 November 2026: Every public Shopify app that calls the Admin API must have an IP allowlist in place by 11:59 PM Eastern on 20 November, and bulk operations from apps without one get blocked about a week earlier. Shopify recommended the control on 27 October and made it a requirement on 5 November, which leaves developers 15 days ahead of the busiest trading period of the year.

Not yet independently verified. Shopify's changelog page gives two dates for bulk operations: the summary line says 11 November and the body says 12 November. Only the vendor has been read; plan for the earlier date until Shopify settles it. We will update this when it can be confirmed, and remove this note.

Bulk operations go first

The earlier date is the one that could break something. After 11:59 PM Eastern on 12 November, bulk queries and mutations from public apps without an allowlist are blocked, although the summary line on the same page says 11 November. Bulk operations are how many apps sync catalogues, orders and inventory, so a missed deadline would show up as a stalled nightly job rather than an obvious outage.

Shopify's reasoning is simple: a leaked token becomes useless anywhere except the servers on the list. It says it is making this mandatory "with the busiest weeks of the year" close.

Serverless apps get a way through

A fixed list of addresses is hard for an app on serverless or dynamic hosting. Shopify has added support for allowlisting by network, using autonomous system numbers, so those apps can list their provider's network rather than individual IP addresses. That is a wider door than a list of a few servers, and teams with the option of a static egress address will want to weigh the two.

Developers can filter API logs in the Dev Dashboard by token type to find any non-expiring tokens still in use. That matters because this is the second part of a tightening: Shopify has already said it will delist public apps on non-expiring offline tokens from 1 January 2027. Fixing both at the same time is less work than two separate releases.

Merchants can now see who has done it

The change also reaches store owners. Merchants can see an app's security setup in Settings, under Apps, including whether it uses expiring tokens and an allowlist. After 20 November, apps without an allowlist are flagged there.

A retailer that relies on public apps for tax, shipping, loyalty or stock sync can check that page now and ask vendors with gaps when they will close them, rather than finding out during a peak weekend. Private and custom apps are not named in this requirement.

Shopify is in our catalogue. Agencies that maintain public apps for several clients should count how many separate apps they hold, and remember that any new outbound address added during peak-season scaling has to reach the list first.

Related on TrustList:

• Shopify caps Customer Account API at 3,000 requests a minute per customer
• Shopify POS cart calls will reject when the till refuses a change

Sources

• Shopify developer changelog: App security updates, IP allowlist is now required, 5 November 2026, 5 November 2026