Shopify gives public apps an 11-day window to add IP allowlists
Apps using bulk operations need an IP allowlist by 12 November, every other public app by 20 November, after which Shopify starts blocking requests and delisting non-compliant apps.
Shopify published a developer blog post on 5 November requiring every public app to turn on an IP allowlist for Admin API access, with two separate deadlines. Apps that use bulk operations must have an allowlist on by 12 November at 11:59pm ET, or Shopify starts blocking their bulk queries and mutations. Every other public app that calls the Admin API has until 20 November at 11:59pm ET, after which non-compliant apps are delisted from the App Store, blocked from new installs, and flagged as a security risk in merchants’ admin settings.
An IP allowlist restricts Admin API calls to a fixed set of addresses, so a leaked access token is useless outside your own infrastructure. Shopify added ASN support alongside this requirement for apps on serverless or dynamic hosting, letting them allowlist a network range instead of static IPs.
Why it matters: if you maintain a public Shopify app and haven’t set this up, the clock is now under two weeks for the bulk-ops deadline and a little over that for everything else. This sits on top of the expiring-token migration Shopify already announced for January, so app developers are now working two overlapping security deadlines at once.
The caveat: this applies to public apps distributed through the App Store. Custom and merchant-built apps aren’t covered by this requirement.