Shopify has announced a new security measure requiring IP allowlisting for public applications accessing its Admin API. This initiative aims to mitigate the risk of unauthorized use of stolen access tokens. Developers are expected to comply by November 20, 2026, with an earlier deadline of November 12 for applications utilizing bulk operations.
Enhancing Security Measures
Originally introduced as an optional feature on October 27, the IP allowlisting is now mandatory. Shopify’s security enhancement means that the origin of API requests will now be verified, moving beyond simple token validation. This measure is intended to address vulnerabilities highlighted in cybersecurity reports, where stolen credentials could potentially allow unauthorized access to cloud services.
Once implemented, Shopify will assess the source IP of both GraphQL and REST Admin API requests made using app tokens. Requests from non-verified addresses will receive an HTTP 403 error response. Additionally, if Shopify is unable to determine the request’s origin, it will be rejected.
Consequences for Non-compliance
Developers who do not meet the November 20 deadline risk having their applications removed from the Shopify App Store and prevented from installing new instances. However, existing installations will continue until April 1, 2027, after which their API requests will fail. For applications using bulk operations, the deadline is November 12, with merchant warnings beginning January 15.
This policy aims to curb token misuse, a common security threat. While network restrictions offer an additional layer of protection, developers must still safeguard their credentials against potential internal threats.
Implementation Guidelines
Shopify’s guidelines allow developers to specify public IP addresses and address ranges for static infrastructures. For applications with dynamic addresses, hosting networks can be approved using autonomous system numbers (ASNs). Developers may list up to 10 ASNs and limit access to a maximum of 10 countries. These measures provide broader protection compared to individual server addresses.
The configuration process is managed through the Dev Dashboard’s Settings, where developers can test traffic against these restrictions before enforcement. Shopify advises verifying that legitimate requests are not blocked and ensuring that external requests fail to gain access. Notably, selecting IP addresses or networks as the control type is essential, as choosing one will replace the other.
Shopify’s detailed bulk-operation instructions specify November 12 as the cutoff date, although a summary inaccurately lists November 11. Moreover, public applications must transition to expiring offline tokens by January 1, 2027, which will impose expiration periods alongside network limitations.
Overall, these changes reflect Shopify’s commitment to enhancing the security of its platform, ensuring that developers take necessary precautions to protect sensitive data and maintain secure operations.
