Shopify requires IP allowlists for custom apps installed outside the owner’s organisation

What Shopify announced for custom apps

On 11 November 2026, Shopify announced in its developer changelog that custom apps must have an IP allowlist when they are installed on stores outside the organisation that owns them. An IP allowlist limits the network addresses from which an app can call Shopify’s Admin API, which apps use to read and change store data.

The requirement comes in two stages:

• from 11:59pm US Eastern time on 20 November 2026, for new installs;
• from 11:59pm US Eastern time on 1 January 2027, for existing installs.

Shopify’s reason is leaked access tokens: without an allowlist, a stolen token can be used from any network.

Which apps and stores are affected

The usual case for a merchant is a custom app built for your store by an agency or freelancer and owned by their Shopify organisation rather than yours. That app is installed outside its owner’s organisation, so it needs an allowlist. The same applies if your business supplies a custom app to other merchants.

Three kinds of app are not affected: apps installed only on stores within the owner’s own organisation, apps a merchant created in the Dev Dashboard or the Shopify admin, and public apps, which Shopify says are covered by a separate requirement.

Partners who own several apps face an extra rule. From 1 January 2027, a single app without an allowlist affects their ability to install any of their apps on stores outside their organisation. Shopify does not say exactly what happens to an existing install that still has no allowlist after that date, so treat 1 January as a firm deadline.

What to do before 20 November and 1 January

• Find out who owns each custom app on your store. If a supplier built it, ask whether it is installed from their organisation.
• Ask the owner to set the allowlist in the Dev Dashboard. Shopify offers two routes: list fixed IP addresses or ranges if the app calls Shopify from static addresses, or, if its addresses change, allow the hosting provider’s network identifiers (ASNs) and the countries where the app runs.
• If you plan to install a new custom app from a supplier after 20 November, check the allowlist is in place first.
• If you are an agency or partner, audit every app installed on stores outside your organisation and configure each one before 1 January 2027.

A small platform change like this is the kind of thing support after launch should pick up without you asking. If nobody looks after your custom app any more, Cognivise’s ongoing support and ownership service can take it on.