Shopify adds network access rules to shopify.app.toml

Shopify published a developer changelog entry today adding a [network_access] section to shopify.app.toml, the config file every Shopify app ships. It lets a developer declare, up front, which outside hosts their app actually talks to.

There are two properties. allowed_navigation_hosts lists sites the app links customers to from checkout or storefront pages, up to 20 of them, and declaring a host there skips Shopify’s usual warning before a customer follows an outside link. allowed_sources lists up to 20 HTTPS origins the app’s code loads from or sends requests to on storefront, checkout and admin pages, which Shopify uses to spot activity it was not told to expect. Changes take effect after running shopify app deploy and releasing the new version.

[network_access]
allowed_navigation_hosts = ["app.example.com"]
allowed_sources = ["https://api.app.example.com"]

Why it matters: once an app has declared its real network footprint, anything outside that list becomes a signal Shopify can act on, rather than noise buried in checkout traffic. That matters more than usual given how many recent supply-chain incidents have involved a legitimate app quietly calling a host nobody put there on purpose.

The caveat: Shopify describes this as strongly recommended, not mandatory, so nothing breaks if you skip it for now.