Shopify Extends IP Allowlist Rule to Agency-Built Apps

By
Shopify Extends IP Allowlist Rule to Agency-Built Apps
Shopify Extends IP Allowlist Rule to Agency-Built Apps
Affiliate disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you. Full disclosure

Shopify will require an IP allowlist on any custom app a developer installs on someone else’s store, starting with new installs on Nov. 20.

If an agency, a freelancer or a supplier-sync vendor built a private app for your store, this rule is about you. Apps you built yourself are exempt, and public apps already had their own deadlines. The apps your developer owns and your store rents are now on the clock, and that clock runs out one week before Black Friday. I track this beat every day at Ecommerce Paradise.

This follows my Nov. 10 breakdown of the public-app deadlines, so read that one first if the public rule is new to you.

Below you will find the dates, the traffic types Shopify’s docs say will break, my read on where stores get hurt, and five steps you can finish before Nov. 20.

Shopify just decided who may call your store’s API, and it enforces that rule on every app, whoever built it. That is a good reason to keep your store on a platform that treats app security as a platform job. Start your store on Shopify →

Shopify Requires IP Allowlists on Agency-Built Custom Apps

Shopify posted the change on its developer changelog on Nov. 11, 2026, according to the changelog entry. It applies to custom apps installed on stores outside the organization that owns the app. Apps installed only inside the owner’s own organization are not affected. Apps that merchants create themselves, in the Dev Dashboard or in the admin, are not affected either. Public apps fall under a separate rule.

Two dates matter, and both land at 11:59 p.m. Eastern. Nov. 20, 2026 is the deadline for new installs. Jan. 1, 2027 is the deadline for installs that already exist.

Shopify singled out developers who run several apps. Per the changelog, from Jan. 1 a single app without an allowlist affects the partner’s ability to install any app on stores outside its organization. Shopify’s instruction to developers is to audit every app installed outside their organization and configure an allowlist on each one before Jan. 1.

An IP allowlist is a list of server addresses that are allowed to use an app’s access token. Shopify gives a one-sentence reason: “Leaked tokens can be used from any network location.” An allowlist limits the networks from which an app can call the Admin API, so a stolen token is useless anywhere else.

Developers set it up in the Dev Dashboard, per Shopify’s setup guide. They open the app, go to Settings, click Manage in the IP allowlist section, test against recent traffic, then turn on Enforcement. The limits are up to 250 IP entries, up to 10 ASNs and up to 10 countries. An ASN is an autonomous system number, which identifies a hosting provider’s network and helps apps whose IP addresses change. A second Nov. 11 changelog entry says IP addresses and ASNs can now be used together.

Requests from outside the allowlist fail with a 403 status code. The rule covers GraphQL Admin API and REST Admin API requests that use the app’s access tokens. The guide names two traffic types that do not work with an enforced allowlist, because Shopify cannot confirm their source IPs. The first is tokens used by the Send HTTP request action in Shopify Flow. The second is GraphQL Admin API requests from Oxygen-hosted storefronts.

Three things are never rejected, according to the same guide: dev preview requests on dev stores, direct API access from embedded app pages, and direct API access from POS UI extensions.

What is a custom app? Shopify’s help center describes it as an app that you or a developer builds exclusively for your Shopify store. It points merchants who lack development skills to a Shopify Partner. Per the same page, custom apps created before Jan. 1, 2026 are managed from the admin, and new ones are created in the Dev Dashboard.

The changelog leaves one gap. It does not say what happens to an installed app after Jan. 1 if it still has no allowlist, beyond the install restriction on partners with several apps. Plan for the worst case until Shopify says more.

From Public Apps on Nov. 5 to Custom Apps on Nov. 11

This is the second step in a week. On Nov. 5, Shopify told developers that every public app must turn on an IP allowlist by Nov. 20, or by Nov. 12 for apps that use bulk operations, according to its developer blog. Apps that miss Nov. 20 are delisted from the App Store and flagged in each merchant’s Settings, then Apps page.

Merchants see a warning in the admin on Jan. 15, 2027. Admin API requests from non-compliant public apps fail on April 1, 2027, per the same post. Existing installs keep working until that April date.

The same post puts expiring offline access tokens on a parallel track, with delisting on Jan. 1, 2027. I broke that one down in my write-up of the token deadline. Shopify’s stated reason for the speed is holiday timing, since the busiest merchant weeks are close. Its blog says an IP allowlist means a leaked token cannot be used anywhere but the app’s own servers.

Shopify also gave merchants a window into this. Per its Nov. 5 merchant changelog, Settings, then Apps now shows each app’s latest activity and flags security issues. An app’s details page groups access, permissions and activity, labels permissions that may involve sensitive data, and shows whether the app uses expiring access tokens and enforced IP restrictions.

The first public deadline has already passed. A DEV Community post from RAXXO Studios, published Nov. 12, says apps that use bulk operations hit their cutoff that day. The author adds that developers who run Admin API calls from merchant-controlled infrastructure can request an extension. Shopify’s docs page does not describe an extension process, so treat that as one author’s claim.

The counterpoint is real. An allowlist protects against stolen Admin API tokens, and that is all it does. As I noted on Nov. 10, the October checkout hijacks ran through app configuration and a developer’s internal tool, not through stolen merchant tokens. I also tracked a skimmer hidden in an analytics script, which an allowlist would not have touched.

Where allowlists matter is a leaked key. The Railway hosting breach that may have exposed store API keys is the kind of event this rule is built for. A key stolen from a developer’s host stops working from the attacker’s network.

The rule also has a cost. Shopify’s docs say Flow’s Send HTTP request tokens and Oxygen storefront requests get rejected once an allowlist is enforced. So the same switch that blocks a thief can block your own automation, which is why the docs tell developers to test against recent traffic before they enforce.

Why Your Developer’s Custom App Is a Black Friday Risk

My read is that this rule is boring and it will still hurt someone. Most high-ticket stores run at least one app a developer built: a supplier feed that syncs stock, a quote form that pushes leads into a CRM, a pricing tool that enforces MAP, an import from a dealer portal. Plenty of store owners cannot say who owns those apps. If the developer’s Partner organization owns it, your store is a tenant, and “installed outside the organization” describes you exactly.

The setting lives where the app lives. Shopify’s guide places the allowlist in the app’s Dev Dashboard settings, so as far as the docs describe, the app owner flips it and you cannot. That is the whole problem. A rule that your developer must act on is only as good as your developer’s inbox.

Here is how I would sort the answers you get back.

If the developer says the allowlist is already on, you are done. Screenshot the reply and move on. If the developer gives you a date before Jan. 1 and a plan, you are fine, as long as the date is in writing and it does not fall inside Black Friday week. If the developer goes quiet, you have a vendor risk, not a security task, and you need a replacement plan before the new year.

Now the money, as a hypothetical. Say your store does 30 orders a month at a $3,000 average order value. That is $90,000 a month, or about $3,000 a day. If a feed-sync app starts returning 403 errors on Jan. 1 and stock and prices go stale for three days, about $9,000 in orders sit on shaky data. Some become oversells. Some become cancellations, which means refunds, apologies and the occasional dispute. I walked through how fast disputes eat high-ticket margin in my chargeback prevention guide.

The calendar makes this sharper. Nov. 20 is a Friday, seven days before Black Friday on Nov. 27. Adobe forecasts $275.1 billion in U.S. online holiday sales from Nov. 1 to Dec. 31, up 6.7%, with Cyber Week at $47.5 billion, according to Retail TouchPoints. Nobody wants a surprise integration fix in the middle of that.

So here is my rule for the next two weeks. Do not install a new custom app, and do not reinstall an existing one, between Nov. 20 and Cyber Monday on Nov. 30, unless the developer confirms in writing that the allowlist is on. Shopify has not said whether a reinstall counts as a new install. I would assume it does and ask first.

I would also push enforcement for existing apps into early December. Shopify’s own guide says to test against recent traffic and then switch on Enforcement. Changing how your store’s API traffic is filtered during peak week adds risk with no payoff, because existing installs have until Jan. 1. A window between Dec. 1 and Dec. 15 clears the rush and still beats the deadline.

Check the odd cases too. If you use Flow’s Send HTTP request action with an app token, or you run a custom Oxygen storefront, ask your developer how those requests will behave under an enforced allowlist. Shopify’s docs say both get rejected. If you run a Hydrogen build, my guide to headless Shopify explains what you signed up for.

Ownership is the other half of this. If a custom app keeps your store running and you do not control it, you have a dependency you cannot fix yourself. I laid out the questions to ask about price, timeline and who owns the code in my agency comparison guide. Apps that your own store creates are exempt from this rule, and Shopify recommends but does not require an allowlist for apps used only inside your own organization.

Email and SMS tools are a different case. Big names like Klaviyo are public apps, so the Nov. 20 public-app rule governs them and their developers carry that work. Your job there is only to check the status flags in Settings, then Apps.

If you would rather start with a store where the app stack stays small from day one, look at my turnkey done-for-you high-ticket store builds. Fewer apps means fewer keys to lose, and I would rather you own your stack than rent it.

Not sure which of your apps are custom builds or who owns them? Let’s go through your app list together before Nov. 20. Get the private coaching details →

5 Steps to Audit Your Custom Apps Before Nov. 20

What I’d do this week, in this order. The five steps fit in one afternoon plus a day of waiting on replies.

  1. List every app and its owner. Open Settings, then Apps, and write down each app, who built it, and whether it is public or custom. Use the new status flags for expiring tokens and enforced IP restrictions. Make sure the email on your store owner account is an inbox you control, such as one on Google Workspace, so developer notices reach you. If you want help building the sheet, hire a virtual assistant on OnlineJobs.ph, and keep the admin login yourself.
  2. Send each custom app owner the same four questions. Is the IP allowlist enabled today? If not, on what date will it be? Does the app call from fixed IP addresses or from a hosting network that needs ASNs? Does it rely on Flow’s Send HTTP request action or an Oxygen storefront? Ask for answers in writing by Nov. 18.
  3. Freeze custom app installs and reinstalls from Nov. 20 through Nov. 30. Tell your team and your agency. If something truly must go live in that window, require proof that the allowlist is on before the install.
  4. Set a dated plan for existing apps. Ask for enforcement to be tested against recent traffic and switched on between Dec. 1 and Dec. 15. Ask who watches for 403 errors afterward and how you will hear about them. Put the date on your calendar, not theirs.
  5. Line up a fallback for any owner who stays silent. Check whether a public app can replace the custom one, or whether a developer should rebuild it inside your own organization, where the rule is only recommended. Shopify’s redesigned Partner Directory now builds profiles from collaboration history and drops ratings, which I covered in my post on the directory change. If you need extra hands for integrations, my staff augmentation guide shows how that works.

While you are in the admin, test your own checkout on desktop and mobile and confirm the address is your domain or Shopify’s checkout. If you manage the store from cafes or airports, use a VPN such as Surfshark. The security basics are in my guide to managing Shopify on public Wi-Fi.

If you want a second set of eyes on the whole store, book a discovery call and we will go through it.

Frequently Asked Questions

Does this apply to custom apps I built myself in my admin?
No. Per Shopify, apps created by merchants in the Dev Dashboard or the admin are not affected. For apps used only inside the owner’s own organization, Shopify recommends an allowlist but does not require one.

Can I turn on the allowlist for an app my developer built?
Probably not. Shopify’s guide puts the setting in the app’s Dev Dashboard settings, which the app owner controls. Ask your developer, and if you own the app, follow the steps in Shopify’s guide.

Will my store break on Nov. 20?
Nothing in the changelog says installed apps stop working on Nov. 20. That date applies to new installs. Installs that already exist have until Jan. 1, 2027, and Shopify does not describe what failure looks like beyond the install restriction on partners with several apps.

How is this different from the public-app rule?
Public apps face bulk-operation blocking on Nov. 12, delisting on Nov. 20 and failed Admin API requests on April 1, 2027. Custom apps installed outside their owner’s organization face a Nov. 20 deadline for new installs and a Jan. 1 deadline for existing ones. I explained the public timeline in my earlier post.

What is an ASN and do I need to understand it?
An ASN identifies the network of a hosting provider. Developers use it when an app runs on serverless hosting and its IP addresses change. You only need to know that Shopify allows up to 10 ASNs per app and recommends pairing them with countries.

Is this the same as the expiring token deadline?
No. Shopify’s Oct. 27 changelog told developers to migrate to expiring offline access tokens before Jan. 1, 2027. The two rules run side by side, and I covered the token side in my token deadline post.

I am just starting a store. Do I need any of this?
Not yet. You likely have no custom apps. Pick your niche first with my free high-ticket niches list. Then read my guide to what high-ticket dropshipping is, and add apps only when a real problem shows up.

Already selling and want my team to scale the store you have, with the apps, ads and suppliers cleaned up for 2027? See the scaling service →

If you do one thing before Nov. 20, send the four questions to every developer who has ever built something for your store. The answers take a day to come back, and they tell you who you can count on during the biggest week of your year.

Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

Related Articles

If this was useful, these go deeper:

Share on Facebook
Post on X
Save
Share