The Maze: Shopify is giving developers of public apps two November deadlines to limit where their app credentials can be used. Apps that use Shopify’s bulk processing tools to read or update large batches of store data have the earlier deadline, November 12. The risk for merchants starts there. An app can still appear in a store’s settings even if a catalog job it runs has stopped.
The Details:
The two deadlines affect different parts of the app. Shopify first recommended the security setting on October 27 for apps that connect from fixed network addresses. On November 5 it made the setting mandatory for public apps. After 11:59 p.m. Eastern time on November 12, 2026, Shopify will block bulk operations from public apps that lack the setting. These are background jobs that can read or update large batches of store data. After 11:59 p.m. Eastern time on November 20, Shopify will remove public apps that still lack the setting from the App Store and block new installs. Shopify exempts custom apps and apps merchants create in the Dev Dashboard or in Shopify admin.
A stolen credential works from fewer places. Apps use a credential called a token to reach the Admin API, Shopify’s interface for reading or updating store data. Developers turn on an IP allowlist in the Dev Dashboard. This tells Shopify which network addresses may use the app’s token. An app that connects from fixed addresses can list those addresses or ranges. If the addresses change, the developer can allow the hosting provider’s network and narrow it to the countries where the app runs. Other customers may use that same network, so the broader option can still leave a stolen credential usable from some servers. Shopify lets developers check which requests from the past 30 days would be blocked before they switch on the rule. Developers of public apps that send requests from merchants’ own infrastructure can apply for an extension.
Installed apps face a separate timetable. The November 20 delisting leaves existing installations in place, subject to the earlier block on bulk jobs. At that point Shopify will also flag apps missing the setting in the merchant’s app settings. On January 15, 2027, Shopify plans to display a warning in the store admin. On April 1 it will start rejecting general Admin API requests for public apps still missing the required protection. Shopify says the change reduces the harm from leaked credentials and that it wants the protection in place before merchants’ busiest weeks.
MarketMaze Take:
The first sign of trouble for a merchant could be stale data. If a public app pulls the full product catalog in one bulk job, that refresh can fail after November 12 while the app still opens and Shopify has yet to flag it. A store team that depends on the refresh can ask the developer to verify that the job completed and returned fresh data. For the developer, the same test should cover the actual network that runs the job, especially if it differs from the main app’s network. The November 20 listing deadline is a separate concern for teams that rely on new installs.
