Secure your app with network access rules in `shopify.app.toml`
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on October 27, 2026.
This Shopify update is categorized as Platform, New.
What changed
The new network_access section has two properties: allowed_navigation_hosts: The external sites your app links to from the storefront, such as your own domain. Shopify normally warns customers before sending them to a site outside the storefront. Links to these hosts skip that warning. List each host exactly as it appears in your links, up to 20. allowed_sources: Up to 20 HTTPS origins that your app's code loads from or sends requests to on storefront, checkout, and Shopify admin pages.
Who is affected
Any app whose code links to or contacts external servers from a storefront, checkout, or the Shopify admin can use the new section.
What action may be needed
For all apps, we strongly recommend you: Add the hosts that your app links customers to, such as your app's own site, to allowed_navigation_hosts. Add the servers that your app's code loads from or sends requests to, such as your API or CDN, to allowed_sources. Run shopify app deploy and release the new version. For examples, see Declare your app's network access.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →