Shopify is making an IP allowlist a requirement for public apps that call the Admin API. The allowlist limits where an app's access tokens can be used: only from the server addresses or networks the developer lists. A leaked token then can't be used from anywhere else.
The deadline is November 20, 2026 at 11:59 PM ET. For apps that run bulk operations, it is November 12, 2026 at 11:59 PM ET. After that date, bulk queries and mutations from public apps without an allowlist are blocked. Existing installs keep working until April 1, 2027.
What you may notice
You can now see each app's security setup in Settings > Apps. After November 20, apps without an IP allowlist are flagged there. If an app you rely on is flagged, ask its developer when they will turn the allowlist on. An app that runs bulk operations may stop working after November 12 if it has not.
What to do this week
- Open Settings > Apps and check whether any app shows a flag or a security warning.
- Note the apps that matter most for sales, orders and stock.
- Ask those developers whether they are ready, and by which date.
Written with AI from the source above. If something looks off, the source is what counts.
