Shopify is tightening the security of custom apps that communicate with the Admin API. Beginning November 20, 2026, any new custom app installed on a store outside the organization that created it must include an IP allowlist. By January 1, 2027 the same rule applies to every existing install. If you’re building or maintaining custom apps for multiple merchants, this change directly impacts how you authenticate, where you host, and how you manage credentials. In this post we break down the update, identify who’s affected, and give you a clear, actionable roadmap to stay compliant.
What Changed and When?
Shopify’s new policy makes IP allowlists mandatory for custom apps that are installed on stores outside the app‑owner’s organization. The rollout has two phases: • Nov 20, 2026 11:59 PM ET – any new install must include an allowlist. • Jan 1, 2027 11:59 PM ET – all existing installs must be updated with an allowlist, otherwise the app will be blocked from calling the Admin API. Public apps are not covered by this rule; they follow a separate security requirement.
Who Is Affected?
Developers & Partners – If you own a custom app and have installed it on any client store that is not part of your own Shopify organization, you must add an IP allowlist to that app. The rule also scales: from Jan 1, 2027, a single app missing an allowlist will prevent all apps in that partner’s portfolio from being installed on external stores. Merchants – Store owners who have installed third‑party custom apps from another organization will see those apps stop working unless the app developer has configured an allowlist. In practice, merchants won’t need to take any action, but they should verify with their development partners that the change has been implemented.
How to Configure an IP Allowlist
Example JSON schema (shown in the Dev Dashboard UI) for a static‑IP allowlist:
{
"allowlist": [
"203.0.113.10",
"203.0.113.0/24",
"198.51.100.0/22"
]
}
Example for a dynamic‑IP environment (using ASNs and country codes):
{
"allowlist": [
"AS16509", // Amazon Web Services
"AS15169", // Google Cloud
"US", // All US‑based egress ranges
"CA" // Canada
]
}
Impact on Existing Apps and Partner Organizations
If you manage multiple custom apps, treat the allowlist as a global compliance gate. Starting Jan 1, 2027, Shopify will reject API calls from any app lacking an allowlist, and the rejection cascades – a single non‑compliant app can block the installation of all apps owned by that partner on external stores. The safest path is to audit your entire app portfolio today, add allowlists where missing, and document the IP ranges you rely on. Partners should also communicate the upcoming change to their merchant clients, providing a timeline and reassurance that the update will not affect store performance once the allowlist is in place.
Testing and Validation Tips
Next Steps & Call to Action
By treating IP allowlists as a core part of your app’s security posture, you not only stay compliant with Shopify’s new requirement but also protect merchants from the fallout of credential leaks. If you need help updating your apps or want a review of your current network configuration, feel free to reach out in the Shopify Community forums or schedule a short consult with our security team. Stay secure, stay ahead, and keep building great experiences for your merchants!
