Review App Access and Security Directly in Shopify Admin

Shopify has rolled out a powerful update to the Apps section of the admin. From Settings > Apps, merchants can now see each app’s latest activity, permission details, and security status in one unified view. This post breaks down exactly what changed, who needs to pay attention—merchants or developers—and the concrete steps you should take today to keep your store safe and compliant.

What’s New in the Apps Index

The Apps index now lists every installed app with three new data points: • Recent activity (last API call, webhook triggers, etc.)

• Security flags highlighting missing best‑practice measures

• A concise permission summary that labels any scope that touches sensitive data (orders, customers, payments).

Why It Matters for Merchants

Merchants often install dozens of third‑party apps without a clear view of what each app can do or how securely it operates. The new dashboard gives you:

Immediate visibility into apps that haven’t implemented expiring access tokens, reducing the window for token theft.

Alerts when an app lacks enforced IP restrictions, which could allow unrestricted API access from any location.

A quick way to audit permissions—if an app only needs read‑only product data but requests write access to orders, you can spot that mismatch instantly.

Implications for Developers

Developers aren’t just passive observers; the update surfaces compliance gaps that Shopify expects you to close. If your app is flagged for:

• Not using expiring access tokens, you’ll see a “Token expiration required” warning.

• Missing IP‑allowlist enforcement, you’ll see a “IP restrictions missing” warning.

These warnings appear on the app’s detail page for every merchant that has installed it, potentially affecting adoption and trust.

How to Review App Access and Security

Open Settings > Apps in your Shopify admin.

Locate the app you want to inspect; the list now shows a small badge if security measures are missing.

Click the app name to open its detail page. Here you’ll find three sections:

• Permissions – every OAuth scope the app requested, with “Sensitive” labels for data like payments or customer emails.

• Activity – a timeline of API calls and webhook events.

• Security – status of expiring tokens and IP restrictions.

For developers, use the Shopify Help Center link on the page to see Shopify’s recommended implementation patterns.

Actionable Checklist for Merchants

• Scan the Apps list for any app showing a security warning badge.

• Open the app’s detail page and verify that “Expiring access tokens” is set to Enabled.

• Confirm that “IP restrictions” are Enforced (or request the app developer to add them).

• Re‑evaluate permissions: if an app requests more data than it needs, revoke the unnecessary scopes from Apps > Manage private apps or contact the developer.

• Document any apps that need follow‑up and set a reminder to re‑audit quarterly.

Next Steps for Developers

If your app is flagged, you have a clear path to fix it:

Implement Expiring Tokens – Use Shopify’s OAuth flow with the offline_access scope set to true and configure token lifetimes (e.g., 30 days). Renew tokens before they expire.

graphql

mutation {

appInstallationUpdate(id: "gid://shopify/AppInstallation/12345", input: {accessTokenExpiration: "30d"}) {

appInstallation {

accessTokenExpiration

}

Add IP Whitelisting – In your API client, restrict calls to the store’s IP addresses. Store the approved IP list in your app’s settings and reject any request from outside that range.

ruby

allowed_ips = ['203.0.113.10', '198.51.100.22']

request_ip = request.ip

halt 403 unless allowed_ips.include?(request_ip)

Update Scopes – Only request the scopes you truly need. If you added write_orders for a feature that only reads orders, remove it and submit an updated OAuth request.

Communicate – Add a notice in your app’s onboarding flow that explains the new security checks and how merchants can verify compliance.

Once changes are live, Shopify will automatically clear the warning badges for merchants who have the updated version installed.

Conclusion

Shopify’s new “Review app access and security” view puts transparency front‑and‑center, giving merchants the power to spot risky integrations fast and pushing developers toward best‑practice security. By scanning the Apps page today, revoking unnecessary permissions, and ensuring your own apps use expiring tokens and IP restrictions, you protect your store and build trust with shoppers.

Ready to audit your store? Head to Settings > Apps now, and for developers, roll out the token‑expiration and IP‑whitelist updates this week. Stay secure, stay compliant, and keep selling with confidence!