Shopify public-app IP allowlists: November deadlines and setup

Which apps and dates are affected?

Shopify’s November 5, 2026 announcement requires all public apps to configure an IP allowlist: a restriction on the networks from which an app’s tokens can invoke the Admin API. Custom apps and apps created by merchants in the Dev Dashboard or Shopify admin are unaffected by this public-app requirement. The setup guide still recommends allowlists for custom apps.

November 12, 2026 at 11:59 PM ET: bulk queries and bulk mutations from public apps without an IP allowlist will fail. November 20, 2026 at 11:59 PM ET: those apps will be delisted from the Shopify App Store and blocked from new installs, and flagged to merchants in Settings > Apps. The setup guide explicitly says existing installs keep working.

The current setup guide lists two later stages: merchants using the app see an admin warning on January 15, 2027, and Shopify rejects the app’s GraphQL Admin API and REST Admin API requests on April 1, 2027. It does not specify a cutoff time or time zone for those two later dates. They do not extend the November configuration deadlines.

For static egress, use the actual public IP or CIDR

Inventory the public egress addresses your backend services, queues and scheduled jobs actually use to call Shopify. If a server sits behind a NAT gateway, list the gateway’s public address rather than the server’s private address. Include the relevant IPv6 addresses when requests use IPv6. Buying a proxy address does not automatically make it your app’s actual egress.

IP mode accepts up to 100 addresses or ranges, one per line. CIDR notation describes an address range as an address followed by a prefix length. Use /16 or narrower for IPv4 and /32 or narrower for IPv6; a higher prefix number means a smaller range. An entry without a prefix denotes one address.

Start a range at its network address. Shopify’s documentation uses 203.0.113.0/24 to illustrate the format; 203.0.113.7/24 is not the correct network boundary. These are documentation examples, not real app egress addresses to copy into a production allowlist. List only public ranges you are authorized to use and that actually carry the app’s requests.

For dynamic egress, check ASN countries and shared scope

Dynamic egress can be allowed through a hosting provider’s ASNs. An ASN identifies a network. Enter up to 10 public ASNs, one per line, as a number with or without the AS prefix. Private, reserved and documentation ASNs are not allowed. A provider may operate several ASNs and add more over time, so its brand name alone is not a complete network inventory.

Preferably select the countries where the app actually runs, up to 10. Without countries, the listed ASNs are allowed from anywhere. Shopify uses MaxMind GeoLite to look up the source IP’s ASN and country. The country is where the data locates the address, not where the network owner is registered. A missing ASN, or a missing country when you have selected countries, causes rejection.

A shared ASN also covers the provider’s other customers. Someone who has a stolen token and runs a server in an allowed shared network may still use it. Prefer the app’s specific IP addresses when possible. ASN and country restrictions do not replace token protection, permissions management or incident response.

Test recent traffic before turning on Enforcement

First, an authorized app administrator should open the app in the Dev Dashboard, choose Settings, and select Manage in IP allowlist. Under Allow requests from, choose IP addresses or Networks (ASN), then enter the addresses and ranges, or the ASNs and countries where the app runs.

Second, select Run test under Test against recent traffic. Check which of your own addresses from the last 30 days would be blocked. Compare the result with your hosting provider’s documentation and your app’s Dev Dashboard Logs to identify actual egress. Correct omissions and test again. The most recent requests can take a few minutes to appear.

Third, turn on Enforcement and Save once the rules are ready. The official guide also asks you to make an authorized GraphQL Admin API request from outside the allowlist and confirm a 403. Perform that check only in an app environment you are entitled to administer, while protecting the token. This article describes the documented procedure; it does not report access to merchant logs, token use or a live API test.

Flow, Oxygen and preview requests have different boundaries

The current guide says allowlists are incompatible with access tokens used by Shopify Flow’s Send HTTP request action. Shopify cannot confirm those requests’ source IPs and rejects them. The same limitation applies to token-based GraphQL Admin API requests from a storefront hosted on Oxygen. Teams using these paths should review their architecture; a broader CIDR is not evidence that the incompatibility is resolved.

The guide also lists requests that this mechanism never rejects: Dev preview requests on dev stores and Direct API access requests from an app’s embedded pages. Those exceptions do not prove that a backend job’s actual public egress has passed the rules.

This is separate from the storefront Network access testing preview, which checks external links and source declarations and only issues warnings. The allowlist governs the source networks using tokens to call the Admin API. Passing the storefront preview does not complete this allowlist configuration.

For a 403, identify the request that was rejected

With enforcement on, Shopify checks the source of GraphQL Admin API and REST Admin API requests that use the app’s tokens. A source outside the allowlist, or one Shopify cannot confirm, returns 403, subject to the explicit exceptions above. Retain the status code, request identifier, time, API type and actual egress, then compare the address, ASN, country and current rules. Avoid repeatedly retrying the same rejected request without a bound.

A 403 alone neither identifies an allowlist problem nor proves that token migration and permissions are correct. Use the actual response and current official guidance. Changing networks cannot bypass public-app eligibility, migration deadlines, token permissions or Shopify rules. Before using new egress, confirm that it is authorized app egress covered by the rules.