Shopify's New IP Allowlist Is Mandatory: How to Set It Up Without Breaking Your App

Shopify is making IP allowlisting mandatory for all public apps that use the Admin API. Here's what the enforcement deadlines mean, how to configure IP addresses or ASNs, and why serverless hosting can cause unexpected 403 errors if you get the setup wrong.

If you run a public Shopify app, open your Shopify Dev Dashboard and check your app's Settings.

You may already have noticed a new security requirement:

Enforced IP restrictions: Missing

Shopify has introduced Admin API IP allowlisting to prevent stolen app access tokens from being used outside the networks your application operates on.

The requirement applies to all public apps, and the enforcement deadlines are approaching quickly.

But there is a problem that many solo founders and small development teams could overlook.

If your application runs on platforms such as Railway, Render, Fly.io, Heroku, or Vercel, your outbound IP addresses may not be fixed.

Simply copying an IP address from your hosting dashboard and adding it to Shopify's allowlist might not be enough. Your application could continue making API requests from other networks and start receiving HTTP 403 errors once enforcement is enabled.

We recently configured IP restrictions for a live Shopify app running on Railway. What we discovered during Shopify's 30-day traffic test changed our original implementation plan.

A policy that appeared correct on paper would have blocked approximately 69 legitimate API requests.

Here's what Shopify's new requirement means, how to configure it safely, and what we learned from implementing it in production.

1. What Are Shopify's Enforced IP Restrictions?

Shopify's IP allowlist restricts where an application's access tokens can be used to make Admin API requests.

When enforcement is enabled, Shopify checks the source IP address of every GraphQL Admin API and REST Admin API request made using your app's access tokens.

If a request originates outside your configured allowlist, Shopify rejects it with an HTTP 403 response.

Requests whose source IP address Shopify cannot verify are also rejected.

In practical terms:

• Your application makes an Admin API request from an approved server or network: the request is allowed.
• Someone steals an access token and attempts to use it from an unapproved server: the request is rejected.
• Your own application makes a request from an IP address you forgot to include: that request is also rejected.

This is why the new setting matters.

A leaked access token should not be enough for someone to access a merchant's store data from anywhere on the internet.

Shopify introduced the IP allowlist in the Dev Dashboard under:

Your App → Settings → IP allowlist

If you see the red "Missing" status, your app does not yet have an enforced IP restriction policy.

Official documentation: Shopify IP allowlist requirements and setup.

2. Why Is Shopify Making IP Allowlisting Mandatory?

An Admin API access token allows an application to access merchant data and perform actions according to its granted permissions.

Depending on the scopes, this can include reading or modifying products, customers, orders, inventory, and other store information.

If an attacker obtains a valid access token, they may be able to use it from their own infrastructure.

Consider a common security mistake.

A developer accidentally exposes a token through:

• An application log.
• A debugging endpoint.
• An improperly secured database.
• A compromised dependency.
• An exposed environment variable.
• An insecure backup.

These are not hypothetical. The October 2026 checkout hijacking incidents and the PHP2Shell vulnerabilities both showed how quickly a compromised dependency can turn into exposed credentials across an app ecosystem.

Without additional restrictions, someone holding that token may be able to make Admin API requests until the token becomes invalid.

IP allowlisting adds another security layer.

Even if a token is leaked, Shopify checks whether the request originates from a permitted network.

Shopify recommends pairing IP allowlisting with expiring offline access tokens.

The two controls solve different problems:

Security control	What it protects against
IP allowlisting	Token use from unapproved networks
Expiring offline access tokens	Long-term use of leaked tokens
Both together	Reduces both where and how long a leaked token can be used

Neither control replaces secure token storage, proper access scopes, or application security practices.

3. Shopify IP Allowlist Enforcement Deadlines

Shopify confirmed the mandatory IP allowlist timeline in its November 5, 2026 developer changelog.

All public apps are affected.

The enforcement happens in stages, so the consequences of missing the first deadline are different from those of missing the final one.

Deadline	What happens
November 12, 2026, 11:59 PM ET	Bulk queries and bulk mutations from public apps without an IP allowlist are blocked.
November 20, 2026, 11:59 PM ET	Public apps without an IP allowlist are delisted from the Shopify App Store and blocked from new installs.
January 15, 2027	Merchants using affected apps see a warning in Shopify admin.
April 1, 2027	Shopify rejects GraphQL and REST Admin API requests from apps without the required IP restrictions.

Existing installations can continue working after the November 20 delisting deadline, but that does not mean they are permanently exempt. The final enforcement date affects their Admin API requests too.

Important: If your app uses bulk operations, November 12 is your immediate deadline. Do not wait until November 20.

This requirement arrived alongside a wider set of platform changes. For the full picture of what shifted for developers this cycle, see our Shopify Editions Fall '26 guide.

Do custom Shopify apps need IP allowlisting?

Shopify's mandatory requirement applies to public apps.

Custom apps and apps created by merchants through the Dev Dashboard or Shopify admin are not subject to the same mandatory App Store enforcement timeline.

However, Shopify strongly recommends IP allowlisting for custom apps too.

If you have a custom integration handling sensitive merchant data, implementing this additional protection is still worthwhile.

Source: Shopify's official IP allowlist enforcement announcement.

4. IP Addresses vs. ASN: Which Option Should You Choose?

This is the most important technical decision when configuring your allowlist.

Shopify supports two approaches:

1. IP addresses and CIDR ranges.
2. Networks identified by Autonomous System Numbers (ASNs).

You must choose one mode. Saving one replaces the other.

Option A: IP addresses and CIDR ranges

This is the narrowest and generally preferred approach.

You specify the public IP addresses from which your application makes Admin API requests.

For example, if your application uses a dedicated server with a fixed outbound IP, you can add that address to Shopify.

You can also specify CIDR ranges when multiple addresses need to be included.

Shopify's current limits are:

• Up to 100 IP addresses or ranges.
• IPv4 ranges must be /16 or narrower.
• IPv6 ranges must be /32 or narrower.
• Only public IP addresses are accepted.
• If your application uses a NAT gateway, allowlist the gateway's public addresses.
• Include IPv6 addresses if your servers use IPv6 to reach Shopify.

Best for: Applications running on dedicated infrastructure, fixed-IP VPS servers, or hosting environments with static outbound IP support.

Option B: Networks using ASN

ASN stands for Autonomous System Number.

An ASN identifies a network operated by an organization, such as a cloud hosting provider or internet service provider.

Instead of allowing individual IP addresses, Shopify lets you allow the network associated with your hosting infrastructure.

This is particularly useful for applications running on platforms where outbound IP addresses can change.

Shopify currently supports:

• Up to 10 ASNs.
• Up to 10 countries.
• Public ASNs only.
• Country restrictions to narrow the permitted network locations.

For example, a hosting provider might operate infrastructure across several networks. Your application could make requests through more than one of them.

Rather than trying to maintain a list of constantly changing addresses, ASN mode allows the relevant networks.

However, there is a security trade-off.

A hosting provider's ASN is shared with other customers. Someone operating another server within an allowed network could potentially use a stolen token from that network.

Shopify explicitly recommends allowing individual IP addresses whenever possible and restricting ASN entries to the countries where your application operates.

Best for: Serverless applications, dynamic-IP hosting, and PaaS environments where obtaining fixed outbound IP addresses is difficult.

Shopify's official guidance: IP address and ASN configuration rules.

5. How to Set Up Shopify IP Allowlisting: Step by Step

Before enabling enforcement, identify every part of your infrastructure that makes Admin API requests.

This includes your main web application, background workers, scheduled jobs, and any separate services using Shopify access tokens.

Third-party platforms connected to your app belong on that inventory too. An affiliate platform such as PartnerDock, for instance, hooks into your install handler and reads Shopify Partner API data. The Partner API is a separate API and is not covered by this requirement, but working out which of your integrations touch the Admin API and which do not is exactly the exercise worth doing before you enable enforcement.

Once you know where the requests originate, follow these steps.

Step 1: Open your app in the Shopify Dev Dashboard

Navigate to the Shopify Dev Dashboard.

Select your public app.

Open:

Settings → IP allowlist → Manage

You should see the section titled "Allow requests from".

Step 2: Choose your allowlist mode

Select either:

• IP addresses
• Networks (ASN)

If your infrastructure has fixed outbound IP addresses, choose IP addresses.

If your infrastructure uses dynamic or mixed outbound IP addresses, ASN mode may be more appropriate.

Do not choose based solely on the hosting provider's marketing documentation. Check the actual networks your application uses.

Step 3: Enter your IP addresses or ASNs

For IP address mode, enter each public IP address or valid CIDR range.

For ASN mode, enter the relevant autonomous system numbers.

Also select the countries where your application actually makes Admin API requests.

This country restriction is recommended by Shopify because allowing an ASN without country restrictions permits matching requests from anywhere in that network.

Step 4: Run the 30-day traffic test

This is the most important step.

Before enabling enforcement, find the section titled:

Test against recent traffic

Click:

Run test

Shopify checks your proposed allowlist against your application's Admin API traffic from the last 30 days.

It identifies requests that would be blocked under the proposed policy.

This is where you can catch missing IP addresses, unexpected cloud provider networks, and background services that use different outbound routes.

Results may take a few minutes to include your most recent requests.

If the test identifies requests that would be blocked, do not enable enforcement yet.

Investigate the source networks, update the allowlist, and run the test again.

Step 5: Enable enforcement

Once the test confirms that legitimate traffic is covered:

1. Toggle Enforcement on.
2. Click Save.
3. Allow the configuration to take effect.
4. Test your application's normal Admin API operations.

Shopify also recommends making an Admin API request from outside the permitted networks and confirming that it receives HTTP 403.

Step 6: Monitor your application

After enabling enforcement, monitor:

• GraphQL Admin API errors.
• REST Admin API errors.
• HTTP 403 responses.
• Background job failures.
• Scheduled task failures.
• Webhook-triggered API operations.

Pay particular attention to services that may not run continuously.

A background worker that executes only once every few days might not be represented in recent traffic if it has not run during the test window.

The 30-day test is a safety net, not a substitute for understanding your architecture.

6. How to Find Your App's Real Outbound IP Addresses and ASNs

Do not rely exclusively on your hosting provider's dashboard.

Shopify provides a useful way to inspect the actual source addresses of your application's API requests.

Open:

Shopify Dev Dashboard → Your App → Logs

Find the GraphQL request entries.

These logs show the client IP address and associated ASN for the request.

Review requests from all your application services and identify the networks they use.

You can then use this information to determine whether IP address mode or ASN mode is appropriate.

Important: Do not confuse API logs with webhook logs

This distinction is easy to miss.

Shopify sends webhooks to your application. In that situation, Shopify is the sender and your infrastructure is the receiver.

But when your application calls the Admin API, your infrastructure is the sender.

IP allowlisting evaluates the source of the Admin API request.

Therefore, inbound webhook logs do not tell you which outbound IP addresses your application uses to reach Shopify.

Use the GraphQL request logs for this investigation.

7. The Serverless Trap: How a Railway App Almost Got Its Own Requests Blocked

This is where our implementation experience becomes particularly useful.

We recently configured IP restrictions for a live Shopify application running on Railway.

The application had two separate services making Admin API requests:

1. Web service

Responsible for webhooks, embedded admin interactions, and customer-facing API operations.

2. Background worker

Responsible for scheduled jobs and background processing.

Both services communicated with Shopify using the application's access tokens.

Our initial assumption was straightforward.

We were running on Railway, so we would allowlist Railway's network and enable enforcement.

That seemed reasonable.

But when we inspected Shopify's GraphQL request logs, we discovered something unexpected.

Some of our requests were originating from AWS IP addresses rather than the expected Railway network.

The hosting platform was in the middle of migrating to its own network backbone, which meant outbound traffic was not consistently using the network we had initially expected.

A Railway-only ASN policy would therefore have blocked legitimate requests.

The Shopify 30-day traffic test exposed the problem.

It identified approximately 69 requests from AWS networks that would have been rejected by our original policy.

These were not irrelevant requests or random background traffic.

They were legitimate application operations that supported real customer-facing functionality.

Had we enabled enforcement without running the test, we could have introduced production failures without realizing why.

How we fixed it

We switched to ASN mode.

Instead of allowing only the hosting platform's network, we included both:

• The hosting platform's ASN.
• The additional cloud provider ASN identified in the GraphQL logs.

We also restricted the permitted countries to the relevant operating locations.

Then we ran the test again.

The result:

Zero requests flagged as blocked.

Only after validating the revised policy did we enable enforcement.

Five lessons from the implementation

1. Never assume your outbound IP addresses.

Your hosting provider's name does not tell you every network your requests will use. Inspect the actual GraphQL request logs.

2. Always run Shopify's 30-day test.

The test identified approximately 69 legitimate requests that our initial policy would have blocked. It is worth taking the extra few minutes.

3. Account for every service.

Your web application is not necessarily your entire application. Workers, cron jobs, scheduled tasks, and other backend services may use different outbound networks.

4. Use ASN mode when static egress IPs are not practical.

It is a realistic option for dynamic-IP infrastructure, but remember that it grants access to a broader shared network. Restrict countries and pair it with expiring offline tokens.

5. Treat enforcement as a production change.

Do not enable it during a busy period without checking your application logs, background jobs, and API operations first.

The takeaway is simple: the right allowlist is based on where your requests actually originate, not where you think your application is hosted.

8. Pair IP Allowlisting With Expiring Offline Access Tokens

Shopify recommends using IP allowlisting alongside expiring offline access tokens.

These are separate security requirements, and both deserve attention.

An ordinary non-expiring offline access token can remain valid until the merchant uninstalls the app or its credentials are revoked.

If that token leaks, the attacker may retain access for an extended period.

An expiring offline access token is different.

It lasts one hour. Shopify issues refresh tokens that allow the application to obtain replacement access tokens without requiring the merchant to repeatedly authorize the app.

The two security mechanisms work together:

• IP allowlisting restricts where the token can be used.
• Token expiry limits how long a leaked access token remains valid.

For public apps, Shopify requires expiring offline access tokens for Admin API requests.

The announced enforcement timeline is:

Deadline	Consequence
January 1, 2027	Public apps still using non-expiring offline tokens are delisted and blocked from new installs.
January 15, 2027	Merchants see an admin warning.
April 1, 2027	Admin API requests using non-expiring offline tokens are rejected.

These deadlines are separate from the IP allowlist requirements.

If you have not migrated your token handling, do not assume that enabling IP restrictions completes your app's security migration. Our 2026 Shopify app security guide covers the other changes landing across the same period.

Shopify also documents application-only access tokens for supported public app backend operations, including scheduled jobs and webhook handlers.

Review the official documentation:

• Use expiring offline access tokens
• Migrate to expiring offline access tokens

9. Important Compatibility Limitations

Before implementing IP allowlisting, check whether your application uses any of the following integrations.

Shopify Flow's Send HTTP request action

Shopify cannot confirm the source IP for Admin API requests made using app tokens through this action. These requests are rejected when the restriction applies.

Oxygen-hosted storefronts

GraphQL Admin API requests originating from storefronts hosted on Shopify Oxygen cannot be verified in the required way and are rejected.

Dev preview requests

Dev preview requests on development stores are not rejected.

Direct API access from embedded app pages

Direct API access requests from your app's embedded pages are also exempt from rejection.

These distinctions matter because not every request associated with your app follows the same network path.

If your architecture relies on Shopify Flow or Oxygen for Admin API calls, review the compatibility documentation and redesign the affected integration before enforcement.

Official reference: Shopify IP allowlist compatibility.

10. Shopify IP Allowlist Implementation Checklist

Use this checklist before turning on enforcement.

Infrastructure discovery

• Identify every service that calls the Shopify Admin API.
• Include the main web application.
• Include background workers.
• Include scheduled jobs and cron tasks.
• Identify any separate cloud or third-party services making API requests.
• Review GraphQL request logs for actual client IP addresses and ASNs.

Allowlist configuration

• Decide between static IP addresses and ASN mode.
• Add every relevant public IP address or CIDR range, or the required ASNs.
• If using ASN mode, restrict the countries where the application operates.
• Check that all production services are covered.
• Run Shopify's 30-day traffic test.
• Investigate every legitimate request that would be blocked.
• Repeat the test until there are no unexpected blocked requests.

Enforcement and monitoring

• Enable enforcement.
• Save the configuration.
• Verify that requests from outside the allowlist return HTTP 403.
• Test normal application operations.
• Test background jobs and scheduled tasks.
• Monitor Admin API 403 responses after activation.
• Review outbound API logs periodically.

Additional security

• Migrate to expiring offline access tokens.
• Verify refresh-token storage and rotation.
• Review access scopes.
• Check application logs for exposed credentials.
• Ensure secrets are stored securely.

Frequently Asked Questions

What does Enforced IP Restrictions Missing mean in Shopify?

It means your public app does not currently have the required IP allowlist enforcement enabled. You need to configure approved IP addresses or ASNs in the Shopify Dev Dashboard and enable enforcement.

Is Shopify IP allowlisting mandatory for all public apps?

Yes. Shopify requires all public apps to configure an IP allowlist. The requirement covers apps making Admin API requests, with the November 12 deadline for apps using bulk operations and November 20 for all other public apps.

Does Shopify IP allowlisting affect existing app installations?

Existing installations are not immediately disabled when an app is delisted on November 20. However, Shopify's final enforcement begins on April 1, 2027, when affected Admin API requests are rejected.

What happens if I enable IP restrictions with the wrong IP address?

Shopify rejects Admin API requests from outside your allowlist with HTTP 403. This can break customer-facing operations, background jobs, and scheduled tasks. Use the 30-day test before enabling enforcement.

Should I use IP addresses or ASN mode for Railway?

It depends on your actual outbound network configuration. If you have stable, dedicated egress IPs, IP address mode is preferable. If your requests originate from dynamic or multiple provider networks, ASN mode may be more practical.

Does Shopify IP allowlisting support Render, Fly.io, Vercel, and Heroku?

Shopify's ASN support is designed for applications hosted on dynamic-IP infrastructure, including serverless and PaaS environments. Verify the actual networks used by your application rather than assuming one provider ASN covers every request.

Does IP allowlisting affect Shopify webhooks?

No. IP allowlisting evaluates outbound GraphQL and REST Admin API requests made using your app's tokens. Incoming Shopify webhooks are a different communication direction and are not the requests this restriction evaluates.

Why am I getting 403 errors after enabling IP restrictions?

Your application may be making Admin API requests from an IP address or ASN that is not included in the allowlist. Check your GraphQL request logs, identify the source network, update your policy, and verify the change.

A 403 can also have other causes, such as insufficient API scopes. Check the response details before assuming every 403 is an IP restriction failure.

Do custom Shopify apps need IP allowlisting?

Custom apps are excluded from the mandatory public app enforcement timeline. Shopify still recommends IP allowlisting as a security best practice.

Can I change my IP allowlist after enabling enforcement?

Yes. You can update your allowlist in the Dev Dashboard. If necessary, Shopify also allows you to disable enforcement while retaining the configured allowlist. Plan changes carefully so that legitimate requests remain covered.

Final Thoughts: Don't Let a Security Update Become a Production Outage

Shopify's IP allowlist requirement is an important improvement to app security.

For developers, however, the challenge is not simply adding an IP address and switching on enforcement.

You need to understand your infrastructure's actual outbound traffic, account for every service that calls the Admin API, choose the correct allowlist mode, and validate the configuration before applying it to production.

Our Railway implementation demonstrated why this matters. A seemingly reasonable provider-only policy would have blocked approximately 69 legitimate API requests.

The 30-day traffic test caught the issue before it reached production.

If you run a public Shopify app, check your Dev Dashboard today.

If you use bulk operations, prioritize the November 12 deadline. For all other public apps, November 20 is the deadline to avoid App Store delisting and new-install restrictions.

Run the test before enabling enforcement. Your merchants should never have to discover your IP allowlist configuration was wrong through a broken app.

For more practical Shopify developer guides, platform updates, and app ecosystem analysis, follow The SaaS Hub.