Shopify has turned a recommended security control into an urgent requirement for public apps, setting two November deadlines that land before the 2026 Black Friday-Cyber Monday rush.
In a Nov. 5 developer update, Shopify said public apps that call the Admin API must turn on an IP allowlist by Nov. 20, 2026, at 11:59 p.m. ET. Apps that use bulk operations have an earlier deadline of Nov. 12, 2026, at 11:59 p.m. ET.
After Nov. 12, bulk queries and bulk mutations from public apps without an IP allowlist will fail. After Nov. 20, public apps without an IP allowlist will be delisted from the Shopify App Store and blocked from new installs.
Existing installs are not fully cut off on the Nov. 20 App Store deadline. Shopify’s app security documentation says existing installs keep working at that stage, with merchant-facing warnings starting Jan. 15, 2027, and affected GraphQL Admin API and REST Admin API requests rejected from Apr. 1, 2027. The Nov. 12 bulk-operation block is earlier and separate.
Shopify says custom apps and apps created by merchants in the Dev Dashboard or Shopify admin are not affected by the public-app requirement, though its documentation still recommends allowlists for custom apps.
Why the timing matters
The App Store deadline arrives one week before Black Friday, which falls on Nov. 27, 2026. The bulk-operation deadline arrives even earlier, giving affected app teams only seven days from Shopify’s Nov. 5 announcement.
Shopify tied the timing to holiday readiness, saying the busiest weeks of the year for merchants are almost here. The commercial stakes are high. In its 2025 Black Friday-Cyber Monday release, Shopify said merchants generated US$14.6 billion in global sales over the weekend, up 27% from 2024, while noting that the figures were based on gross merchandise volume, approximate, unaudited, and subject to adjustment.
For merchants, losing bulk-operation access can affect tools tied to exports, imports, catalog updates, reporting, fulfillment workflows, or other large-scale data jobs. The block on new installs arrives at the point when many stores are trying to avoid tooling changes before holiday traffic peaks.
What Shopify is trying to lock down
An IP allowlist limits where an app’s access tokens can be used. Shopify’s documentation says that when enforcement is on, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request that uses the app’s tokens. Requests from outside the approved addresses or networks fail with a 403 status code. Requests whose source address Shopify cannot confirm also fail.
The control is designed to reduce the damage from leaked tokens. If a token is exposed, the allowlist limits Admin API access to the networks the developer approved instead of allowing use from any server.
This narrows one path of abuse rather than solving app security by itself. Shopify’s broader app-security guidance also covers expiring offline access tokens, authenticated requests, webhook verification, cross-shop data isolation, secret handling, and account protection.
Serverless apps now have an ASN path
The requirement could have been harder for apps without fixed outbound IP addresses, so Shopify added support on Nov. 5 for allowlisting by autonomous system number, or ASN.
Apps with static egress can list specific public IP addresses or CIDR ranges. Apps using serverless or dynamic hosting can list their hosting provider’s ASNs and narrow those networks by country.
Shopify warns that ASN allowlisting is broader than IP allowlisting because provider networks are shared with other customers. Its guidance says developers should allowlist IP addresses when possible and, when using ASNs, list only the countries where the app runs.
The current documentation says an IP allowlist can include as many as 100 addresses or ranges. ASN rules allow as many as 10 ASNs and as many as 10 countries.
Merchants will see more app security context
Shopify also updated the merchant side of app security visibility. A Nov. 5 Shopify changelog says Settings > Apps now shows more information about connected apps, including latest activity, security issues that may need attention, sensitive-data permission labels, and whether an app has adopted required security measures such as expiring access tokens and enforced IP restrictions.
The Shopify Help Center says these security checks are not an overall security rating and do not guarantee that an app is safe or unsafe. The checks can show as configured, missing, or unknown.
For store operators, the useful reading is whether an app developer is keeping pace with Shopify’s requirements, not whether a single badge fully measures risk. If an app shows a missing security measure, Shopify says merchants can keep the app, contact the developer, or uninstall it after considering business impact and making a transition plan.
Part of a wider app-security push
The allowlist mandate follows a wider Shopify app-security campaign. On Oct. 20, Shopify told app developers it was seeing attacks increase across the app ecosystem as AI gets better at finding vulnerabilities.
On Oct. 27, Shopify said all public apps that call the Admin API must migrate to expiring offline access tokens before Jan. 1, 2027. Missing that deadline leads to App Store delisting and blocked new installs on Jan. 1, merchant warnings on Jan. 15, and affected Admin API requests returning 403 from Apr. 1.
Developer next steps
Shopify directs developers to configure the allowlist in the Dev Dashboard and test it against recent traffic before turning on enforcement. Developers who run bulk operations should also check that the relevant operations are enabled in the Partner Dashboard. Shopify made that a separate requirement for partner-built apps on Nov. 6 and enabled access for apps that already used those operations.
Apps that make Admin API calls from merchant infrastructure are a special case. Shopify says developers should move as quickly as possible to an architecture that better limits exposure of Admin API tokens and can submit a request for an extension to the deadlines.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
