IP allowlists are now required for public apps
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on November 05, 2026.
This Shopify update is categorized as Action Required, Platform, Update.
What changed
We're enhancing protection of merchants by adding IP allowlist configuration as a requirement for public apps. All public apps using bulk operations must configure an allowlist by November 12, 2026, and all other public apps must configure an allowlist by November 20, 2026. If an app is not migrated by these dates: November 12, 2026 at 11:59 PM ET.: Bulk operations from public apps without an IP allowlist will fail to execute. November 20, 2026 at 11:59 PM ET: Public apps without an IP allowlist will be delisted from the Shopify App Store and blocked from new installs. What apps are affected All public apps.
Who is affected
Shopify app developers using the API or platform feature named in this update should review the official change.
What action may be needed
Configure your app's allowed IPs in the Dev Dashboard: If your app calls Shopify from static IP addresses, configure your IP allowlist based on static IPs or CIDR range. If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in. For setup instructions, see Restrict API access with an IP allowlist. What if my app makes Admin API calls from merchant infrastructure?
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →