Shopify just rolled out a powerful preview feature that lets you test an app’s network_access settings right on a development store. If your app links to external resources—or makes API calls from a storefront page—this tool helps you confirm that every host and server is correctly whitelisted, preventing unwanted exit warnings and spotting potential security gaps before you go live.
What Changed
When you create a dev store with the network_access_testing feature preview enabled, Shopify adds two non‑blocking safety nets:
Both checks run automatically as you browse the dev store, giving you real‑time feedback on any missed hosts or servers.
Who’s Affected
Any public or private app that renders storefront content, injects scripts, or fetches data from external endpoints should use this preview. The feature is especially critical for:
Shopify recommends every app adopt these settings to keep navigation experiences smooth and to help the platform flag suspicious outbound traffic.
How to Enable the Network Access Testing Preview
?preview=network_access_testing or enable it via the Store Settings → Features panel (look for “Network access testing”).allowed_navigation_hosts.[Shopify Network Access] Request to unlisted host xyz.example.com for any request outside allowed_sources.network_access object, reload the page, and repeat until no warnings appear.Sample network_access Configuration
Your app’s shopify.app.toml (or the JSON manifest for a custom app) should contain a network_access section. Below is a minimal example that covers both navigation and source allowances:
toml
[network_access]
# Domains that can be navigated to from a storefront link without showing an exit warning.
allowed_navigation_hosts = ["cdn.example.com", "shopifycdn.com"]
# Domains that the storefront is allowed to fetch resources from (scripts, images, APIs).
allowed_sources = ["api.example.com", "assets.example.com", "fonts.googleapis.com"]
If you add a new third‑party analytics script, for instance, remember to list its host in allowed_sources. Likewise, any affiliate link that redirects shoppers off‑site must be added to allowed_navigation_hosts to avoid the default warning.
Best Practices for Ongoing Compliance
allowed_sources. This catches accidental additions early.Conclusion & Next Steps
The network access testing preview gives you confidence that your app’s external calls are transparent and safe before you ship to live merchants. By iterating through the warnings, updating your network_access manifest, and following the best‑practice checklist, you’ll reduce friction for merchants, keep shoppers safe, and stay aligned with Shopify’s security standards.
Ready to put the feature to work? Enable the preview on a dev store today, run through the steps above, and share your findings with the Shopify Partner community. Happy coding!
