Shopify Dev
IP allowlists are now required for public apps (opens in a new tab)
Public apps must configure IP allowlists by Nov 20, 2026.
Shopify Dev· Nov 5, 2026· 9/10
Shopify Dev
Public apps must configure IP allowlists by Nov 20, 2026.
Shopify Dev· Nov 5, 2026· 9/10
Shopify Dev
Shopify Dev· Nov 5, 2026· 9/10· 94% relevant
IP allowlist now mandatory for all public apps, enhancing security.
RelatedShopify Dev
Shopify Dev· Nov 5, 2026· 8/10· 90% relevant
Serverless apps can now use ASNs for IP allowlists.
RelatedShopify Dev
Shopify Dev· Oct 27, 2026· 8/10· 89% relevant
IP allowlist feature now restricts Admin API token usage to specified IP ranges, adding an extra layer of security for app developers.
RelatedShopify Dev
Shopify Dev· May 11, 2026· 8/10· 87% relevant
Expiring offline access tokens required for all public apps by January 1, 2027
RelatedShopify Dev
Shopify Dev· Oct 7, 2026· 8/10· 84% relevant
New per-customer rate limit of 3000 requests/min for Customer Account API.
RelatedShopify Dev
Shopify Dev· Oct 20, 2026· 8/10· 84% relevant
Recommends immediate security actions for app developers, including scanning with new security checker and following best practices to mitigate rising attacks.
Related