Two dates, with different consequences
Shopify published the requirement on November 5, 2026. Public apps that use Admin API bulk operations must configure and enable an IP allowlist by November 12 at 11:59 p.m. Eastern Time. After that point, bulk queries and mutations from an unconfigured public app are blocked. Other public apps that call the Admin API have until November 20 at 11:59 p.m. ET; apps still without an allowlist are then delisted from the App Store and blocked from new installs. Shopify says existing installations continue working until April 1, 2027, when Admin API requests from affected apps fail.
The November 20 date is not a grace period for bulk operations: the earlier November 12 enforcement applies to them. Shopify also says affected apps will be flagged in merchant settings from November 20 and that merchant warnings are planned for January 15, 2027. These are separate stages, so developers should not interpret an existing installation continuing temporarily as evidence that migration is complete.
Public apps are in scope; custom apps are not
The requirement applies to public apps, including those distributed through the Shopify App Store. Shopify identifies custom apps and apps created by merchants in the Dev Dashboard or admin as unaffected by this specific public-app mandate. That distinction does not make a custom app immune to credential risk: restricting the networks allowed to call an API can still reduce the usefulness of a leaked token where the platform supports it.
A merchant using an app should ask its developer whether the app calls the Admin API, whether it performs bulk operations, and whether the allowlist is already enforced. A merchant generally cannot supply an app developer’s egress address on the developer’s behalf. The action belongs to the app owner, although a merchant may need to test app workflows after the developer changes hosting or network configuration.
Static addresses and serverless networks
Apps with stable outbound IP addresses can list those addresses or their CIDR ranges in the Dev Dashboard. A serverless service may use changing egress addresses, making a single-address list brittle. Shopify’s November 5 update adds a Networks option: the developer can allow a hosting provider’s autonomous system numbers (ASNs), constrain the permitted countries, test the selection against recent traffic, and then enable enforcement. Shopify documents a maximum of ten ASNs and ten countries; requests from outside the configured networks return HTTP 403.
ASN rules are broader than a single fixed address, so they require careful provider and geography selection. They are not a reason to allow every provider network or every country. Confirm that all legitimate production regions and background jobs are represented, and review recent traffic before enforcement. Shopify’s developer guidance also points teams with dynamic egress to the ASN option rather than guessing addresses.
A migration checklist for app teams
First inventory every public app, Admin API integration, background worker and bulk operation. Record the production egress path for each environment; development and preview traffic should not be confused with production. Next, choose static IP/CIDR or a narrowly scoped ASN-and-country rule based on the hosting design. Test the proposed rule against recent traffic, verify ordinary and bulk workflows, and only then enable enforcement.
After rollout, monitor 403 responses and API error rates, keep the allowlist aligned with planned infrastructure changes, and document an owner for future edits. Test a rollback or recovery procedure before the deadline rather than waiting for a production call to fail. For merchants, the practical step is to contact the app provider now and schedule a post-migration check of orders, inventory sync and other critical functions.
Sources & further reading
Have a factual correction or a source to suggest? Contact the editorial desk.
