Shopify now requires an IP allowlist on apps that call the Admin API. From 20 November 2026, 11:59 pm ET (10:29 am IST on 21 November), public apps without one are delisted from the App Store and blocked from new installs, and custom apps installed on stores outside the developer’s organisation cannot be installed on new stores without one. Existing custom-app installs have until 1 January 2027. Apps you created yourself in your own admin are not affected.
That last line is the important one for most merchants. This is a developer-side change, but it lands in your store the week before Black Friday. So here is a short decision guide: find your situation, do the one thing listed against it.
In our experience of working with Shopify merchants and building custom Shopify applications, API security is not just a technical requirement. It is an important part of protecting business operations and customer data. We have seen how applications depend on multiple integrations, servers, and third-party services, which makes it essential to have proper control over API access.
My recommendation to merchants and Shopify app developers is simple: don’t wait until the deadline. Speak with your app developers, identify which applications access the Shopify Admin API, and make sure their IP allowlists are configured correctly. A small security update today can prevent unnecessary disruption during the busiest retail season of the year.
What actually changed
An IP allowlist tells Shopify which networks an app is allowed to call the Admin API from. If an access token leaks, it is useless from anywhere else. Shopify’s own reasoning is short: leaked tokens can be used from any network location. Developers set the allowlist in the Dev Dashboard, either as static IPs and CIDR ranges or, for apps on serverless hosting, as the host’s ASNs plus the countries the app runs in. Since 11 November an allowlist can mix IPs and ASNs and hold up to 250 IPs.
| Date (ET) | Who | What happens |
|---|---|---|
| 12 Nov 2026 | Public apps using bulk operations | Bulk operations fail without an allowlist |
| 20 Nov 2026 | All public apps | No allowlist: delisted, blocked from new installs |
| 20 Nov 2026 | Custom apps installed outside the owner’s organisation | Allowlist needed for new installs |
| 1 Jan 2027 | Same custom apps | Allowlist needed for existing installs too |
| 1 Jan 2027 | Public apps on non-expiring offline tokens | Delisted and blocked from new installs |
| 1 Apr 2027 | Same public apps | Admin API calls with old tokens return 403 |
Decision guide: find your situation
If you only use apps you created in your own Shopify admin
Do nothing. Merchant-created apps, whether made in the admin or in the Dev Dashboard, are outside this rule.
If an agency or freelancer built a custom app for your store
This is the group most likely to be caught out. If the app lives in their Partner or Dev Dashboard organisation and is installed on your store, it counts as “installed outside the organisation”. Send them one message today: “Has the IP allowlist been configured for our custom app, and is it tested?” Typical examples are ERP or warehouse sync, custom pricing logic and loyalty integrations. Your existing install keeps working until 1 January, but a new install (a new expansion store, a staging store, a reinstall after a scope change) will be blocked from 20 November.
If you run several stores (Shopify Plus expansion stores)
Check every store, not only the main one. Shopify also warns partners that from 1 January one non-compliant app can limit their ability to install any app on stores outside their organisation. If one vendor serves all your stores, one missed app can hold up the rest.
If you depend on public App Store apps
Most serious vendors will comply in time. Make a list of the five apps your checkout, fulfilment or inventory cannot live without and, on 21 November, confirm they are still listed. If one is not, ask the vendor directly what it means for your existing install; Shopify’s notice talks about delisting and blocking new installs, and you do not want to discover the rest during a sale.
If you plan to install a new app for BFCM
Install and test it before 20 November, or check after that date that it is still in the App Store. I would not add new apps in the last week before a sale anyway, but this year there is one more reason.
If your own servers or middleware call the Admin API
Some setups run an app’s Admin API calls from merchant infrastructure, for example an on-premise ERP connector. Shopify says these should move to an architecture that limits token exposure, and it offers an extension request form on the public apps changelog post. Ask your developer whether that applies to you.
If you are the developer
Audit every app installed outside your organisation, add the allowlist in the Dev Dashboard (static IPs, or ASNs plus countries for serverless), test it on a dev store, and put the expiring offline token migration on the same sprint. Both deadlines touch the same code.
My view
The timing is awkward, one week before Black Friday. The change itself is overdue. Plenty of stores still run a custom app that someone built three years ago, with a token nobody has rotated since. A leaked Admin API token can read orders and customer data, and that is a far bigger problem than one afternoon of configuration. If this push makes merchants ask “who built this app and where does it run?”, it has done its job. It is the same thinking behind my earlier piece on Shopify, ChatGPT and the new era of commerce: more systems now touch your store, so you need to know which ones and from where.
How Binary helps
At Binary Web Solutions we build and maintain custom apps for Shopify Plus brands. For this change we can list every custom app on your stores, tell you who owns each one, and configure and test the allowlist and token migration for the ones we manage. For more on how we approach Shopify builds, see the Okhai case study and the rest of the Shopify section.
FAQ
Will my store stop working on 20 November?
Not from this date alone. Shopify’s notices for 20 November describe delisting non-compliant public apps and blocking new installs, and existing custom-app installs have until 1 January 2027. One exception already applies: since 12 November, bulk operations from public apps without an allowlist fail. Ask the vendors of your critical apps if they are compliant.
Do apps I made in my Shopify admin need an IP allowlist?
No. Shopify excludes merchant-created apps and apps installed only on stores within the developer’s own organisation.
What if my app runs on serverless hosting with changing IPs?
Allow your hosting provider’s ASNs and list the countries your app runs in. Shopify added ASN support on 5 November for exactly this case.
Useful before the sale
- Need it built for you? Binary does this for Shopify Plus brands: custom app audits, allowlists and token migration.
- SupportHub Helpdesk by DiGiMAA: if something does break mid-sale, customer complaints land in one dashboard instead of five inboxes. Free on the Shopify App Store.
- Ommniverse, my book on online and offline customer experience: for the bigger question of what your tech stack owes the customer.
Sources
- Shopify changelog: IP allowlists required for custom apps installed outside your organization (11 Nov 2026)
- Shopify changelog: IP allowlists required for public apps (5 Nov 2026)
- Shopify changelog: migrate to expiring offline access tokens before 1 January 2027
- Shopify docs: set up an IP allowlist in the Dev Dashboard
Tejash Shah is Co-Founder and CTO of Binary Web Solutions, a Shopify Plus agency in Mumbai and Ahmedabad, and founder of DiGiMAA.
