Shopify adds app IP allowlists: check your hosting first

Shopify app teams can now restrict where their Admin API tokens are accepted. The new IP allowlist is useful for apps with fixed public server addresses, but enabling it without checking every caller can block legitimate work.

The 27 October announcement covers both GraphQL and REST Admin API requests. With enforcement enabled, a request from an address outside the configured ranges receives HTTP 403 even if its token is valid.

Check compatibility before enforcement

Shopify’s setup guide says the control currently needs static public IP addresses. Most serverless platforms assign dynamic addresses; support for those environments is still described as coming soon.

The guide also excludes tokens used by Shopify Flow’s Send HTTP request action and GraphQL Admin API calls from Oxygen storefronts. Shopify cannot confirm their source address and rejects them under enforcement. Dev preview requests on development stores and direct API access from embedded app pages are never rejected.

Our recommendation is to list all production callers before changing the setting: web servers, queue workers, scheduled jobs and third party integrations. An address belonging to the interactive app alone may not cover the processes that synchronise orders overnight.

Use recent traffic as a rehearsal

In the app’s Dev Dashboard settings, open Manage under IP allowlist. Shopify accepts up to 100 public addresses or CIDR ranges. Include the public NAT gateway address where relevant and IPv6 addresses if your servers use them. The allowed range sizes are /16 or narrower for IPv4 and /32 or narrower for IPv6.

Run Test against recent traffic before enabling enforcement. It checks the previous 30 days for addresses that the proposed list would reject; very recent requests can take a few minutes to appear. Adjust the list, retest, then enable enforcement and verify that a request from outside it fails. Turning enforcement off preserves the configured addresses.

A clean traffic test is a useful check, but we would also exercise infrequent jobs and failover infrastructure. A server used only during an outage may not appear in the last month’s logs.

Know what this control does not prove

Shopify’s API log guidance explains why unexpected source addresses matter: they can expose use of a stolen token. Requests through a vulnerable endpoint on your own server can still originate from an allowed address. An allowlist therefore complements endpoint security and token expiry; it is not an app safety certificate.

Shopify also introduced network access declarations and a security documentation hub in its wider security update. For merchants, ask vendors which controls fit their infrastructure and what testing they performed. Serverless hosting alone is not evidence that an app is unsafe.

Shopify Developers announces the security update, 27 October 2026

Read Shopify’s announcement on X if the embed does not load.