Action requiredShopify · Apps & tracking · Thu, Nov 5, 2026

Shopify requires an IP allowlist for every public app by Nov 20 (Nov 12 if you use bulk operations)

…

Until Nov 12 for bulk ops; Nov 20 for App Store listing / all public apps (midnight ET)

What changed

Shopify's Nov 5 developer changelog makes the IP allowlist mandatory for every public app that calls the Admin API. Public apps that use bulk operations must turn the allowlist on by November 12, 2026 at 11:59 PM ET, or bulk queries and mutations fail. Every other public app must configure it by November 20, 2026 at 11:59 PM ET, or Shopify delists the app from the App Store and blocks new installs; apps without an allowlist are also flagged in merchant Settings > Apps after that date. Existing installs keep working until Admin API requests fail on April 1, 2027. Custom apps and merchant-created apps are not affected. Apps on serverless hosts can allowlist by ASN (up to 10 ASNs, limited to up to 10 countries) instead of static IPs.

What to do

If you build or maintain a public Shopify app (or use one your team wrote), open the Dev Dashboard IP allowlist settings this week. For static egress, list your IPs or CIDR ranges; for serverless, add your host's ASNs and countries, then test. If the app uses bulk operations, finish before Nov 12; otherwise finish before Nov 20 so you are not delisted ahead of BFCM. Merchants: check Settings > Apps after Nov 20 for any public apps flagged without an allowlist and ask those developers for a timeline.