Shopify’s latest developer changelog introduces a game‑changing feature for apps running on serverless platforms: you can now add your hosting provider’s autonomous system numbers (ASNs) to an app’s IP allowlist. This move tackles the long‑standing pain point of dynamic egress IPs, letting developers secure API calls without hard‑coding static addresses. In this post we’ll unpack the update, explain who needs to act, and walk you through the exact steps to get your allowlist up and running.
Why IP Allowlists Matter for Shopify Apps
IP allowlists are Shopify’s first line of defense against unauthorized traffic. When an app calls the Admin API or GraphQL endpoints, Shopify checks the request’s source IP against the list you’ve defined. If the IP isn’t allowed, the request is rejected with a 403 status. This protects both merchants and Shopify from malicious traffic, rate‑limit abuse, and accidental data exposure. Historically, allowlists required static IP addresses—a simple model for traditional hosted apps but a nightmare for serverless functions that rotate IPs on every invocation.
What Changed: ASN Support for Serverless Hosting
The Settings > IP Allowlist section in the Dev Dashboard now accepts two entry types: individual IP addresses or whole networks identified by ASNs. You can add up to 10 ASNs and optionally restrict them to a maximum of 10 countries where your app runs. After you add the networks, you can test the configuration against recent traffic and then flip the “Enforcement” toggle. Once enforced, any request originating outside the allowed ASNs or IPs receives a 403 response.
Who Is Affected: Developers vs. Merchants
Developers building public or custom apps that run on AWS Lambda, Google Cloud Functions, Vercel, Netlify, or similar serverless services will benefit most—because their outbound IPs are not static. Merchants generally won’t need to take direct action, but they’ll notice more reliable app behavior and fewer “403 Forbidden” errors when the app’s allowlist is correctly configured. In short, developers must update their app settings; merchants reap the security and stability gains.
Step‑By‑Step: Adding ASNs to Your App’s Allowlist
If you also have static IPs (for example, a small VM used for webhook processing), you can keep those entries alongside the ASN entries. Shopify will treat the list as a union of allowed IPs and networks.
Testing and Enforcing the Allowlist
The “Test Allowlist” feature pulls the last 24‑hour request log for your app and highlights any calls that would have been blocked. Review the report, adjust ASN or country selections if needed, and re‑run the test. Once you’re confident, turn enforcement on. Remember: enforcement is global—all API calls, including webhooks, will be subject to the same check. If you rely on third‑party services (e.g., a payment gateway that posts to your webhook endpoint), ensure those services are covered by the ASN list or add their static IPs separately.
Impact on Public Apps and Upcoming Requirements
Shopify has announced that IP allowlists will soon become mandatory for every public app listed in the Shopify App Store. While the enforcement deadline has not been published, the guidance is clear: all public apps should have an allowlist configured today. Using ASNs is the recommended path for serverless apps because it future‑proofs your configuration against IP churn. Failing to add an allowlist may result in API request failures, negative merchant experiences, and potentially removal from the App Store during the compliance audit.
Best Practices and Quick Checklist
Here’s a minimal JSON snippet you might store in your repo for reference:
{
"ipAllowlist": {
"asns": ["AS16509", "AS15169"],
"countries": ["US", "CA"],
"staticIps": ["203.0.113.45"]
}
}
Conclusion & Call to Action
The new ASN‑based IP allowlist removes a major obstacle for serverless Shopify apps, letting you secure API traffic without hunting down ever‑changing IP addresses. Update your app’s settings today, run the built‑in tests, and flip enforcement on before the mandatory‑allowlist deadline hits. Need a hand? Join the #shopify‑dev Slack channel or drop a comment below—we’re happy to help you get your allowlist configured perfectly.
