Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- On a dev store with the preview enabled, undeclared external navigation hosts can show an exit prompt and undeclared server requests can produce browser-console CSP warnings. The preview only warns; it does not block traffic or establish blanket enforcement on merchant stores.
- Use allowed_navigation_hosts for external hosts that your app controls and links to from the online store. Use allowed_sources for external HTTPS origins that app code loads or requests.
- Select Network access testing (handle network_access_testing) when creating the dev store; only one feature preview can be active on a dev store. Run Shopify CLI from the app directory and leave it running.
- Test real online-store pages at the store's myshopify.com address, then inspect the console and Content-Security-Policy-Report-Only response header. Theme-editor and local 127.0.0.1 previews do not provide the same policy evidence.
- Merchant trust and platform-host exceptions can hide exit prompts. Google Fonts does not trigger console warnings but still needs both origins declared, and a Checkout UI extension has its own network-access capability.
What did Shopify add in this preview?
In its November 4, 2026 developer update, Shopify announced a way to check app network-access declarations on a dev store with Network access testing enabled. A link to a host missing from allowed_navigation_hosts can show an exit prompt. A storefront page that loads from or requests a server missing from allowed_sources can produce a browser-console policy warning.
The preview is explicitly a warning tool: it does not block links or requests. Shopify says any app whose storefront code links to external hosts or contacts external servers can use the option, and recommends that apps configure their declarations. The announcement and test steps focus on storefront pages; they do not establish blanket blocking on merchant stores or prove that every app surface uses the same test path.
How do allowed_navigation_hosts and allowed_sources differ?
In the [network_access] section of shopify.app.toml, allowed_navigation_hosts lists external hosts that online-store links send customers to. List only hosts your app controls, such as your own order-status domain. Shopify's example uses a hostname, not a full URL. One declaration in the official example is allowed_navigation_hosts = ["app.example.com"], written on its own configuration line under that section.
allowed_sources lists external servers that app code loads resources from or sends requests to; the examples use HTTPS origins such as https://api.app.example.com or https://cdn.app.example.com. The guide covers theme extensions, App Home, and HTML or Liquid pages served by an app proxy. Do not list Shopify-served theme-app-extension assets files, or the app proxy URL itself, which the store serves from its own domain. These examples show only the documented shapes; they do not establish full wildcard, port, or path-matching syntax.
How do you prepare a dev store for the test?
When creating a dev store, select the Network access testing feature preview; its handle is network_access_testing. Shopify's feature-preview guide says to select a preview during dev-store creation and allows only one preview on a dev store at a time. The official guides do not give a universal account or regional availability list, so confirm that the option appears in your creation flow.
From the app's directory, run shopify app dev --store <your-dev-store>.myshopify.com and keep it running during the test. The CLI installs the app on the store and applies the local [network_access] configuration. Install only the app under test: Shopify combines allowed_sources from every app on the store, so another app's entry can hide a missing source in yours. Then add your theme-app-extension blocks to the theme and turn on the corresponding app embeds.
Where should you inspect the policy and warnings?
Open the real online store at its myshopify.com address and use each feature of the app while watching the browser developer console. Check for exit prompts on undeclared external links and policy warnings for undeclared servers. The evidence must come from the storefront request; App Home or local development output alone does not establish which policy the storefront received.
Confirm that the page response contains a Content-Security-Policy-Report-Only header before interpreting the result. Do not test in the theme editor's Preview or the local 127.0.0.1 theme-extension preview printed by Shopify CLI. Shopify does not add the Content Security Policy to those theme previews, so a quiet console there is not evidence of complete declarations. This is a documentation-based test procedure, not a report of a live merchant-account or app test.
Does a missing exit prompt or console warning prove the list is complete?
No. Shopify may skip exit prompts for its own hosts, popular social or service sites, store domains, and hosts trusted by the merchant. A missing prompt therefore does not necessarily mean the host is in your list. If a request warns even though its source is declared, compare the response header with the actual URL to check whether the declaration matches.
If Content-Security-Policy-Report-Only lists none of your app's servers, first check that shopify app dev is still running. The guide also says Shopify may omit all app servers when the policy is too long or an app's declarations cannot be read; declared servers can warn in that case too. Do not assume every warning means an origin is missing. The console does not warn about Google Fonts; if your app uses them, still include both https://fonts.googleapis.com and https://fonts.gstatic.com in allowed_sources.
What else must you check for checkout extensions and deployment?
The app-level [network_access] declaration does not replace a Checkout UI extension's own network capability. If an extension uses fetch(), configure its separate network_access capability in the relevant shopify.extension.toml as required for that extension. A storefront test on the dev store does not prove that the extension's separate configuration is correct.
After changing a list, wait for shopify app dev to update the preview and repeat the same page and request checks. Before release, shopify app deploy validates both lists again when it creates an app version and rejects entries that do not follow the rules. Shopify says the preview is under development and its behavior may change; neither sample syntax nor a quiet warning result is a complete grammar reference or proof of release readiness.
Sources
Frequently Asked Questions
Can I interpret warnings if the development command rejects a configuration entry?
Resolve the configuration error first. Shopify says shopify app dev checks entries and fails with an error if they do not follow the network_access reference. Correct the entry and start the preview before interpreting warnings against that configuration.
Can I enable this preview on an existing dev store?
The reviewed official steps describe selecting it when creating a dev store. They do not explain how to add it to an existing store. Do not assume an existing-store toggle is available; use the current creation flow to prepare a separate test store when needed.
Do I need a declaration for every resource file or request?
No. The guide says to list each host or source once, even when several parts of the app use it. Omit Shopify-served extension assets and the app proxy URL served by the store's domain. External CDN and API origins still need their actual declarations.
Is Network access testing free?
The announcement and two official guides reviewed here do not state prices or billing terms. They therefore do not establish that it is free or what related services cost. If the creation flow presents plan or billing conditions, check those terms first.