Shopify Mandates IP Allowlisting for Public Apps to Prevent Unauthorized Admin API Access

Shopify is making IP allowlisting mandatory for public apps that call its Admin API, adding a security check to limit the use of stolen access tokens. Developers must enable the control by November 20, 2026, at 11:59 PM ET. Apps using bulk operations face an earlier deadline of November 12 at the same time.

The change turns a security feature introduced on October 27 into a requirement. Shopify will check where API requests come from, rather than relying on a valid token alone. This addresses the risk covered in Cybersecuritynews.com’s cloud API security guide, where stolen credentials can give attackers access to cloud services.

Once allowlisting is active, Shopify checks the source IP of GraphQL Admin API and REST Admin API requests using the app’s tokens. Requests from outside approved addresses or networks receive an HTTP 403 response. Shopify also rejects requests when it cannot confirm the source address.

Apps that miss the November 20 deadline face removal from the Shopify App Store and blocked new installations. Existing installations can continue operating until April 1, 2027, when Admin API requests will fail. However, bulk queries and mutations face the earlier November 12 cutoff. Merchants will receive admin warnings from January 15.

The policy targets token misuse, a risk illustrated by Cybersecuritynews.com’s report on the Internet Archive’s repeated breach through unrotated API tokens. Network restrictions add protection, but developers still need to secure their credentials. An attacker operating inside an approved network could remain within the permitted boundary.

Shopify Mandates IP Allowlisting

Shopify’s setup guide supports specific public IP addresses and address ranges for static infrastructure. Apps with changing addresses can approve hosting networks through autonomous system numbers, or ASNs. Developers can list up to 10 ASNs and narrow access to up to 10 countries. These network rules are broader than individual server addresses.

Developers configure the control under Settings in the Dev Dashboard and test it against recent traffic before enabling enforcement. Shopify recommends checking whether legitimate requests would be blocked, then confirming an outside request fails. Apps must choose either IP addresses or networks, because saving one type replaces the other.

Shopify’s official announcement lists November 12 in its detailed bulk-operation instructions, despite November 11 appearing in its summary. Separately, public apps must migrate to expiring offline tokens by January 1, 2027, adding time limits alongside network restrictions.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.