Shopify Makes IP Allowlisting Mandatory for All Public Apps to Prevent Stolen API Token Abuse

Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen API access tokens. Shopify announced this requirement on November 5, 2026, and set enforcement deadlines right before merchants’ busiest shopping weeks, with restrictions starting on November 12 for applications using bulk operations.

Developers must now specify which public IP addresses, address ranges, or hosting networks can use their applications’ tokens. Instead of accepting valid credentials from any location, Shopify will evaluate the originating network before granting access. This change will reduce opportunities for attackers to misuse leaked tokens from unauthorized sources.

Shopify IP Allowlisting Mandatory

Public apps performing bulk queries or mutations must enable allowlisting by November 12, 2026, at 11:59 PM ET. Shopify will block these operations afterward for noncompliant apps. Other public apps calling the Admin API face a November 20 deadline, also at 11:59 PM ET.

After November 20, applications without allowlists will be delisted from the Shopify App Store, blocked from new installations, and flagged in merchants’ Settings > Apps.

Existing installations otherwise continue operating, subject to earlier bulk-operation restrictions. Merchant-facing admin warnings begin January 15, 2027, followed by rejection of affected GraphQL and REST Admin API requests on April 1.

According to Shopify’s IP allowlist documentation, enforcement checks source addresses for GraphQL Admin API and REST Admin API requests using an app’s tokens. Requests originating outside approved networks receive HTTP 403 responses. Shopify also rejects requests when it cannot confirm their source addresses, making verified network origin an additional access condition.

Static deployments can register up to 100 public addresses or CIDR ranges. IPv4 entries must use /16 or narrower ranges, while IPv6 entries require /32 or narrower prefixes. Applications behind NAT gateways must specify gateway addresses, and IPv6 deployments must include those outbound addresses to avoid blocking legitimate requests.

For serverless environments, developers can instead authorize up to 10 public autonomous system numbers, optionally narrowed to 10 countries. Shopify checks source ASN and country information using MaxMind GeoLite data. Missing ASN information, or missing country information when geographic restrictions apply, causes rejection.

However, ASN approval introduces a security tradeoff: hosting networks contain other customers. An attacker holding a stolen token could still access the API from infrastructure inside an approved network. This limitation reinforces concerns highlighted by API token theft investigations: restricting token use reduces exposure but does not eliminate credential compromise.

Developers should configure rules through the Dev Dashboard and test them against the previous 30 days of traffic before enabling enforcement. Shopify recommends confirming that an external GraphQL request fails afterward. Teams should combine these checks with token lifecycle safeguards, including expiration and monitoring, rather than treating allowlisting as complete protection.

Compatibility requires particular attention. Tokens used through Shopify Flow’s Send HTTP request action, and GraphQL Admin API requests from Oxygen-hosted storefronts, are rejected because Shopify cannot confirm their source IPs. Development preview requests and embedded-page direct API access remain exempt from rejection by this control.

Custom apps are not required to adopt allowlisting, although Shopify recommends it. Developers should also pair network restrictions with expiring offline tokens and review API logs regularly, addressing both where stolen credentials can operate and how long they remain usable.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.