If you’ve ever struggled to keep your Shopify app’s API traffic safe while dealing with both static servers and serverless functions, the newest change to the App IP allowlist is a game‑changer. Effective immediately, the Dev Dashboard now lets you mix plain IP addresses, CIDR ranges, and autonomous system numbers (ASNs) in a single allowlist, and you can add up to 250 entries—more than double the previous cap.
What Exactly Changed?
Previously, the allowlist UI forced you to pick either IP addresses (or CIDR ranges) *or* ASNs. You could list up to 100 IPs or 10 ASNs, but not both. The update removes that restriction:
Who Needs to Pay Attention?
The change is relevant to all public and custom apps on Shopify—whether you’re building a tiny private integration or a high‑traffic SaaS product. Merchants themselves won’t see the UI, but they’ll feel the impact when an app’s requests start failing with a 403 if the allowlist isn’t set correctly.
How to Set Up the New Allowlist
203.0.113.45 or 198.51.100.0/22.AS16509 for Amazon), and optionally select the countries you want to allow. You can add up to 10.{
"ip_allowlist": [
"203.0.113.45",
"198.51.100.0/22",
"2001:db8::/32"
],
"asn_allowlist": [
{ "asn": "AS16509", "countries": ["US", "CA"] },
{ "asn": "AS15169", "countries": [] }
]
}
Best Practices & Security Tips
• Prefer IPs over ASNs whenever possible. An IP or CIDR range ties the allowlist to a specific server, eliminating the risk of other customers on the same provider network gaining access.
• Use ASNs only for truly dynamic workloads such as AWS Lambda, Cloudflare Workers, or other serverless platforms where IPs rotate frequently.
• Leverage country limits on ASNs to shrink the attack surface. If your app only serves merchants in North America, restrict the ASN to US, CA, and MX.
• Test before enforcement – Shopify recommends toggling “Enforcement” off, monitoring logs for 403s, and confirming that legitimate traffic passes. Once you’re confident, enable enforcement to make the allowlist mandatory.
What to Do Next?
If you haven’t already, start building an allowlist for every public or custom app you maintain. The new limits give you plenty of room to future‑proof your configuration, and the mixed‑type support means you won’t need to maintain separate lists for static servers and serverless functions.
Finally, keep an eye on Shopify’s developer changelog for upcoming enforcement dates and any additional refinements. Security is a moving target, and a well‑maintained allowlist is one of the simplest, most effective defenses you can deploy.
Conclusion & Call to Action
The expanded, mixed‑type IP allowlist is a clear signal that Shopify is doubling down on API security. By updating your app’s settings today, you’ll protect your merchants, avoid unexpected 403 errors, and stay ahead of the mandatory enforcement rollout.
Ready to tighten your app’s security? Head over to the Dev Dashboard, configure your new allowlist, and test it against real traffic. Need help? Drop a comment below or join the Shopify Developers Slack channel for live assistance.
