Shopify now requires an IP allowlist on every public app, split into two deadlines this month
Apps using bulk operations needed the allowlist live by November 12, 2026, today, or get blocked
Every other public app has until November 20, 2026, or faces App Store delisting and no new installs
Custom and merchant-built apps are exempt, only apps sold through the Shopify App Store are affected
On November 12, 2026, the first deadline in Shopify's new IP allowlist rule for public apps arrived. Any public app that calls the Admin API's bulk operations and hadn't configured an allowlist gets blocked starting today. Every other public app has until November 20 before the same rule locks it out of new installs.
What Exactly Did Shopify Change?
Shopify's developer changelog made network-level IP allowlisting mandatory for public apps, the ones distributed through the Shopify App Store. Before this, an app's Admin API traffic could come from anywhere the app's server happened to be running, and Shopify just trusted the access token to prove who was calling. Now it checks the source IP of every request against a list the developer configures in the Dev Dashboard, on top of the token. A request from outside that list comes back as a plain HTTP 403, no matter how valid the token attached to it is.
There are two deadlines, not one.
Apps that use bulk operations, the GraphQL bulk queries and mutations larger integrations rely on for things like full catalog syncs, needed the allowlist live by 11:59 PM ET on November 12. That's today.
Every other public app has until the same time on November 20.
Miss the first one and only your bulk calls stop working, everything else about the app keeps running. Miss the second and the whole app gets delisted from the App Store and blocked from new installs, though stores that already installed it keep running it for now.
Shopify hasn't left that gap open forever either. Non-compliant public apps lose Admin API access completely on April 1, 2027. "Existing installs still work" is a grace period, not a pass, and five months is shorter than it sounds once you've got other things queued up.
You configure this with specific IPs or CIDR ranges if your app runs on fixed infrastructure, which is the simple case. If it doesn't, because you're on a host that hands out a new outbound IP every time a function cold-starts, Shopify built an alternative: allowlist by autonomous system number instead, up to 10 ASNs, optionally narrowed to 10 countries. That's the option made for serverless apps specifically, not a workaround someone found.
Does This Affect My App, and What Happens If I Miss It?
Only public apps are in scope. A custom app you built for one store, or an app a merchant created themselves in their own admin, isn't affected at all.
If you've never submitted anything to the Shopify App Store, this has nothing to do with you.
You can stop reading here and go back to whatever you were doing.
If you do run a listed app and you missed today's bulk operations deadline, the fix isn't complicated, it's just urgent now instead of planned. Go set the allowlist. Bulk calls will keep failing with 403s until you do, but nothing else about the app breaks, and turning the allowlist on doesn't require a new app version or a fresh review cycle.
Missing November 20 is the bigger problem, at least on paper. Delisting means new merchants can't find or install your app, which for a small app studio can mean the difference between steady installs and none for however long it takes you to notice and fix it. Current users aren't affected right away.
That's the part worth sitting with for a second. The deadline that feels scary, delisting, is actually the soft one. April 1, 2027, when Admin API calls get rejected outright for every store still running the app, is the one that actually ends it for existing users too. Treating November 20 as "the real deadline, loosely" because installs still work is exactly the mistake Shopify built the later hard cutoff to catch.
There's one more case worth naming. If your app makes Admin API calls from inside a merchant's own infrastructure rather than yours, meaning you genuinely don't control the source IP at all, Shopify has a path for that. You can request an extension instead of just missing the deadline and hoping nobody notices. It's a form to fill out, not a loophole, so don't wait until the 19th to start it.
Why Is Shopify Doing This Now?
The reasoning reported alongside the change is straightforward. A stolen or leaked Admin API access token is only dangerous if it still works wherever the thief tries to use it. Tie that token to a specific IP range or ASN, and a leaked secret sitting in someone's exposed .env file or a compromised CI pipeline stops being useful the moment it leaves your own infrastructure. The thief gets a string of characters that does nothing from their laptop.
It's not an isolated move either. Shopify is also pushing public apps toward expiring offline tokens by January 1, 2027, instead of tokens that live forever once issued. One change shortens how long a stolen credential stays valid. The other shrinks where it works at all. Put side by side, that's a deliberate direction, not two unrelated changelog entries that happened to land in the same quarter.
I'd call this one of the unglamorous changes that's easy to resent and hard to argue against. Nobody enjoys an unplanned Dev Dashboard session on a Thursday. But a leaked token that only works from your own server's IP is a non-event instead of an incident report. I went through a version of this thinking when I wrote up the security review every RAXXO tool passes before launch. The pattern repeats everywhere: the check that feels like overhead in the moment is the one that quietly saves you months later, after you've forgotten you even set it up.
A platform the size of Shopify doesn't add friction like this for a handful of apps. It adds it because somewhere in its own abuse reports, stolen tokens being replayed from unexpected places showed up often enough to justify forcing every public app through a setup step. That's not a detail Shopify's changelog spells out directly, but it's the only reason a company that cares about App Store growth would willingly make onboarding harder.
What Should a Solo Builder Do Today?
First, figure out if this applies to you at all. If every Shopify integration you've built lives inside one store's own admin, you're a custom app by definition and none of this touches you.
If you do have something listed on the App Store, open the Dev Dashboard today, not tonight. Add your server's real outbound IP or CIDR range. That's a two-minute task once you actually know your own server's IP, which is the part people skip and then have to go look up anyway.
If you're on a host with dynamic egress IPs, the kind common on serverless platforms, use the ASN option instead of guessing at IPs that'll change next deploy. Check your host's documentation for its ASN before you start, since typing it from memory is how typos end up in production allowlists.
Test bulk operations against a development store right after. That's the deadline that already passed today, so it's the one to verify immediately rather than assume it's fine because nothing obviously broke. I've run into enough quiet Shopify API quirks myself, like a CSV export that silently shifted columns the moment a product title had a comma in it, to know that "it probably still works" isn't worth trusting without an actual test. Silent failures are the whole theme of today's deadline.
If part of your app's Admin API traffic genuinely originates from merchant infrastructure you don't control, file the extension request now rather than at 11:58 PM on the 20th. Nobody processes that form faster under pressure.
As for RAXXO, none of my own tools are sold as a listed Shopify app. They live as installed theme sections and standalone products, so this rule doesn't touch anything here directly. But if you're building the kind of app that does, don't let the soft deadline fool you into thinking you have until next spring. You have until tonight, or you already have a problem.
Bottom Line
Treat November 20 as the real deadline, not April 1, 2027. A grace period that ends with your app losing Admin API access entirely isn't a grace period worth leaning on, it's a countdown that happens to be long. If you have a public app on the Shopify App Store, the task today is small: open the Dev Dashboard, add your IPs or your ASN, and run one bulk operation against a dev store to confirm it still works.
If your infrastructure doesn't have a fixed IP, the ASN option exists so you don't have to pretend it does. And if some of your Admin API calls run from a merchant's own servers, that extension request is there so this doesn't force a rewrite under deadline pressure.
None of this is complicated work. It's the kind of small, boring task that's easy to leave for later precisely because it's small and boring, right up until later is today and your bulk sync has been failing since midnight ET without anyone noticing.
So here's the actual question, if you run a Shopify app and haven't touched this yet. Do you know right now, without checking, whether your app uses bulk operations at all? If you have to go look, that's the real signal you're already behind.
This article contains affiliate links. If you sign up through them, I may earn a small commission at no extra cost to you. (Ad)
