Shopify’s latest Developer Changelog introduces a powerful new security layer: an IP allowlist for Admin API access. If your app communicates with Shopify from static IP addresses, you can now restrict GraphQL and REST Admin API requests to those trusted ranges. Any request that originates from an IP outside the list is automatically rejected with a 403 error. In this post we break down the update, explain who should care, and walk you through the exact steps to enable and test the allowlist in your own app.
What’s New
The Settings page of every public or custom app now includes an “IP Allowlist” section. From the Shopify Partner Dashboard you can:
• Add single IP addresses or CIDR ranges that represent your server fleet.
• View recent traffic logs to see which IPs have already called your app.
• Toggle enforcement on or off. When enforcement is on, any request using your app’s access token from an IP outside the list receives a 403 response.
This change does not alter the shape of the Admin API itself—queries, mutations, and REST endpoints remain the same. The difference is purely in the network‑level gatekeeping that happens before Shopify processes the request.
Who Needs This Feature
*Developers* who host apps on dedicated servers, VPS, or on‑premise hardware will benefit most. If your outbound IPs are static, the allowlist becomes a simple yet effective way to stop credential leakage or token abuse.
*Merchants* who install private apps that connect to external services gain an extra safety net. Even if a token is inadvertently exposed, an attacker cannot use it unless they also control an allowed IP.
*Serverless* and dynamically‑scaled platforms (e.g., AWS Lambda, Vercel, Netlify) are currently out of scope because their egress IPs can change. Shopify notes that support for these environments is “coming soon,” so keep an eye on future releases.
How to Set Up the IP Allowlist
203.0.113.42
198.51.100.0/24
Sample Configuration for Automated Deployments
If you prefer to keep the allowlist in source control, you can push the list via the Admin API’s App Settings endpoint (available to partner‑level tokens). A minimal JSON payload looks like this:
{
"ip_allowlist": [
"203.0.113.42",
"198.51.100.0/24"
]
}
Send a PATCH request to https://partners.shopify.com/api/apps/{app_id}/settings with the above body. Remember to replace {app_id} with your app’s numeric ID and include the required X-Shopify-Access-Token header.
Testing and Enforcing in Production
While the UI’s test button is handy, it’s good practice to script an end‑to‑end verification:
curl -X POST https://your-store.myshopify.com/admin/api/2024-07/graphql.json \
-H "X-Shopify-Access-Token: $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"query":"{ shop { name } }"}' \
--resolve your-store.myshopify.com:443:203.0.113.42
If the request succeeds (HTTP 200) you’re good to go. Change the --resolve IP to an address outside the allowlist and you should receive a 403, confirming enforcement works as expected.
Best Practices & Considerations
What Happens If You Forget to Enable Enforcement
The allowlist UI lets you save IPs without turning enforcement on. In that mode, Shopify merely records traffic but does not block any calls. This safety net gives you time to validate the list without risking downtime for existing integrations.
Conclusion & Call to Action
Restricting Admin API access by IP is a straightforward, low‑maintenance way to tighten security for any Shopify app that talks to the platform from known servers. By adding your static IPs, testing the configuration, and then toggling enforcement, you gain protection against token theft and accidental exposure without changing a single line of application code.
Ready to lock down your API calls? Head over to your Partner Dashboard, add the IP allowlist, run the quick test, and flip the enforcement switch today. If you run into any hiccups, drop a comment below or reach out on the Shopify Community forums – we’re happy to help you get secure, fast.
