The Maze: Shopify is requiring developers to say which internet addresses their custom apps can connect from when those apps serve stores outside the developer’s organization. This list of approved addresses, called an IP allowlist, makes it harder to use stolen app credentials. It also changes how agencies and app partners roll out integrations to clients: from January, an app they installed months ago can hold up the next installation.
Source: Shopify developer setup guide. Shopify’s instructions show where to add approved addresses and test them against recent traffic before enforcement.
The details
📅 Two deadlines for outside stores. Under Shopify’s November 11 announcement, new installations need an allowlist from November 20, 2026 at 11:59 p.m. Eastern time. The requirement reaches existing installations on January 1, 2027 at 11:59 p.m. Eastern time. It covers custom apps installed on stores outside the app owner’s organization. It excludes apps installed only within that organization and apps merchants create themselves in Shopify admin or the developer dashboard. Public apps follow separate rules.
🔒 Shopify checks where the request comes from. An access token is the credential an app uses to work with store data through Shopify’s Admin API. With enforcement on, Shopify checks the source of requests that use the token and rejects requests from outside the allowlist. Shopify says this limits where a leaked token can be used. App owners set the list in the Dev Dashboard. They can combine fixed addresses and hosting provider networks if different parts of an app connect from different places.
Our take
Make the list part of rollout planning. A partner can get its newest app ready and still have work left on the older integrations that share its account.
📋 Audit the older apps before promising a launch date. In January, a partner needs an allowlist on every app it already installed on outside stores to make a new outside installation. Suppose an agency is ready to install a new inventory app for a client. An older custom app that it installed on another merchant’s store can hold up that rollout if its list is missing. That’s a reason to check every covered app before committing to a date. The announcement does not specify when ongoing requests from every existing app without a list would stop working.
🧪 Test the addresses you rarely use. Shopify’s dashboard can check the previous 30 days of traffic before enforcement. That can catch an address you forgot to approve. It cannot tell you whether a quarterly reconciliation job or a backup system that stayed idle would still connect. Check those paths separately if you rely on them. Keep the list to fixed addresses where possible: a hosting provider’s network can include other customers, so approving the whole network gives the credential a wider set of places where it can be used.
