Shopify Mandates IP Allowlisting for Public Apps to Curb Stolen Admin API Token Abuse
Shopify announced on November 5, 2026 that it is making IP allowlisting mandatory for all public apps that call its Admin API, in order to limit the usefulness of stolen or leaked API access tokens. Instead of accepting any valid token regardless of origin, Shopify will now verify that requests come from developer-approved networks before granting access. The rollout is staged with deadlines set just before merchants' peak shopping season: public apps using bulk queries or mutations must configure an allowlist by November 12, 2026, 11:59 PM ET, while all other public apps calling the Admin API have until November 20, 2026, 11:59 PM ET. Non-compliant apps face escalating consequences, from blocked bulk operations to delisting from the Shopify App Store, merchant-facing warnings in January 2027, and full API request rejection by April 1, 2027. Custom apps and merchant-created apps are exempt, though Shopify still recommends the control for them.
Detalhes técnicos
When enforcement is on, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request that uses an app's tokens; requests from outside the allowlist fail with a 403 status code, and so do requests whose source address Shopify can't confirm. Developers can configure either static IP/CIDR entries (up to 100 addresses, with IPv4 limited to /16 or narrower and IPv6 to /32 or narrower) or, for serverless/dynamic-IP environments, up to 10 ASNs limited to up to 10 countries in the Dev Dashboard's Settings page; once enabled, requests from outside the allowed networks fail with a 403 status code, using MaxMind GeoLite data to resolve ASN and country. An allowlist only supports one mode at a time — an allowlist allows IP addresses or networks, not both. The control does not work with certain request types, including dev preview requests on dev stores, Shopify Flow's HTTP request action, and Oxygen-hosted storefront GraphQL calls, because their source IP cannot be confirmed. Shopify itself acknowledges a residual risk with ASN-based allowlisting: approved hosting networks are shared with other tenants, so a stolen token could still be replayed from infrastructure inside an approved network, meaning the control reduces but does not eliminate the impact of credential theft.
Remediação
Developers should configure rules via the Dev Dashboard's Settings > IP allowlist section, test them against roughly 30 days of recent traffic before turning on enforcement, and verify that requests from outside the configured ranges actually fail. Shopify recommends treating allowlisting as one layer of defense rather than complete protection, pairing it with expiring offline access tokens, client credential controls, and regular API log monitoring to limit both where stolen credentials can be used and how long they remain valid.
Linha do tempo
-
Shopify Mandates IP Allowlisting for Public Apps to Curb Stolen Admin API Token Abuse
ler a análise desta fonte ocultar
Shopify announced on November 5, 2026 that it is making IP allowlisting mandatory for all public apps that call its Admin API, in order to limit the usefulness of stolen or leaked API access tokens. Instead of accepting any valid token regardless of origin, Shopify will now verify that requests come from developer-approved networks before granting access. The rollout is staged with deadlines set just before merchants' peak shopping season: public apps using bulk queries or mutations must configure an allowlist by November 12, 2026, 11:59 PM ET, while all other public apps calling the Admin API have until November 20, 2026, 11:59 PM ET. Non-compliant apps face escalating consequences, from blocked bulk operations to delisting from the Shopify App Store, merchant-facing warnings in January 2027, and full API request rejection by April 1, 2027. Custom apps and merchant-created apps are exempt, though Shopify still recommends the control for them.
Technical Details
When enforcement is on, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request that uses an app's tokens; requests from outside the allowlist fail with a 403 status code, and so do requests whose source address Shopify can't confirm. Developers can configure either static IP/CIDR entries (up to 100 addresses, with IPv4 limited to /16 or narrower and IPv6 to /32 or narrower) or, for serverless/dynamic-IP environments, up to 10 ASNs limited to up to 10 countries in the Dev Dashboard's Settings page; once enabled, requests from outside the allowed networks fail with a 403 status code, using MaxMind GeoLite data to resolve ASN and country. An allowlist only supports one mode at a time — an allowlist allows IP addresses or networks, not both. The control does not work with certain request types, including dev preview requests on dev stores, Shopify Flow's HTTP request action, and Oxygen-hosted storefront GraphQL calls, because their source IP cannot be confirmed. Shopify itself acknowledges a residual risk with ASN-based allowlisting: approved hosting networks are shared with other tenants, so a stolen token could still be replayed from infrastructure inside an approved network, meaning the control reduces but does not eliminate the impact of credential theft.
Remediation
Developers should configure rules via the Dev Dashboard's Settings > IP allowlist section, test them against roughly 30 days of recent traffic before turning on enforcement, and verify that requests from outside the configured ranges actually fail. Shopify recommends treating allowlisting as one layer of defense rather than complete protection, pairing it with expiring offline access tokens, client credential controls, and regular API log monitoring to limit both where stolen credentials can be used and how long they remain valid.