What changed
Public Shopify apps must restrict Admin API token use to listed IP addresses or networks
When
Announced November 5, 2026; bulk operations blocked after November 12; delisting after November 20; API requests fail April 1, 2027
Who it affects
Every merchant using public App Store apps, and the developers who build them
What to do
List apps that run bulk jobs, get written confirmation from each vendor, check Settings > Apps after November 20

Key takeaways

  • Public Shopify apps without an IP allowlist lose bulk operations after November 12 and are delisted after November 20, 2026.
  • Existing installs keep working until April 1, 2027, but inventory sync and feed apps that rely on bulk jobs can break in Black Friday week.
  • Get written confirmation from every bulk data app this week and watch stock across channels daily through Cyber Monday.

Shopify IP allowlist rollout for public apps

  1. Shopify recommends IP allowlists

  2. Allowlists made mandatory for public apps

  3. Bulk operations blocked without an allowlist

  4. Non-compliant apps delisted and flagged

  5. Merchants see admin warnings

  6. Admin API requests fail

What Shopify announced

In its developer changelog dated November 5, 2026, Shopify says it is adding IP allowlist configuration as a requirement for all public apps. An allowlist tells Shopify which servers or networks may use an app's access tokens. Any GraphQL or REST Admin API request from outside that list fails with a 403 error, and so does any request whose source Shopify cannot confirm. The stated reason is token theft: a leaked token can otherwise be used from anywhere.

Shopify first recommended allowlists on October 27. Nine days later it made them mandatory and said why the timing is tight: the busiest weeks of the year for merchants are almost here. Custom apps and apps a merchant builds in the admin or Dev Dashboard are not required to add an allowlist, though Shopify recommends it.

The deadlines merchants need on the calendar

Shopify's documentation sets out a staged rollout. The dates below apply to any public app that has not turned on an allowlist:

  • November 12, 2026, 11:59 PM ET: bulk queries and bulk mutations from those apps are blocked.
  • November 20, 2026, 11:59 PM ET: the app is delisted from the App Store, blocked from new installs and flagged to merchants in Settings > Apps. Existing installs keep working.
  • January 1, 2027: apps still using non-expiring offline access tokens are delisted on the same terms.
  • January 15, 2027: merchants using a non-compliant app see a warning in the Shopify admin.
  • April 1, 2027: Shopify rejects the app's Admin API requests, so the app stops working on your store.

So what: where the money risk sits

Most apps will comply in time; a developer can switch on an allowlist in its Dev Dashboard in minutes. The risk is the long tail of small apps and the specific job that breaks first. Bulk operations are how apps move large amounts of data at once: syncing stock to Amazon, Walmart or a 3PL, pushing product feeds, importing reviews, or editing thousands of prices for a sale. If one of those apps misses November 12, its bulk jobs fail during the run-up to Black Friday, often without an obvious error in your admin.

Worked example, illustrative numbers: a store expects $300,000 in sales across Black Friday week and uses one app to sync inventory between Shopify and its Amazon and Walmart listings. If that sync silently stops for a day and 3% of the week's orders are for units that already sold elsewhere, about $9,000 of orders have to be cancelled, plus refund handling, marketplace cancellation metrics and unhappy first-time buyers. Asking the vendor a two-line question this week costs nothing.

There is a second, quieter catch for teams that built their own tools. Shopify's documentation says allowlists do not work with access tokens used in the Shopify Flow "Send HTTP request" action, or with Admin API calls from storefronts hosted on Oxygen, because Shopify cannot confirm where those requests come from. If your developer turns on an allowlist for a custom app used that way, those calls will fail.

  • Bulk operation apps face the earliest deadline: November 12.
  • Delisting does not switch an app off; the hard stop is April 1, 2027.

What sellers should do

Do this before November 12, and finish it before November 20. Our Shopify apps guide can help you judge replacements if a vendor goes quiet.

  • Ecommerce manager: open Settings > Apps and list every public app. Mark the ones that move data in bulk (inventory sync, marketplace connectors, feeds, review imports, bulk price editors, ERP and 3PL links). Metric: a complete list with an owner per app.
  • Same owner: email each bulk app vendor asking whether its IP allowlist is on and before which date. Metric: written yes from every bulk app by November 10.
  • Ops lead: after November 12, compare stock levels in Shopify against Amazon, Walmart and your 3PL once a day through Cyber Monday. Metric: zero unexplained stock gaps and no oversell cancellations.
  • Ecommerce manager: on November 21, recheck Settings > Apps for the new security flag. Metric: no flagged apps, or a replacement plan for each one before January 15.
  • Developer or agency: if you built custom apps, review any Flow "Send HTTP request" steps and Hydrogen storefronts on Oxygen before switching on an allowlist. Metric: no 403 errors in the app's API logs after enforcement.
  • Founder: freeze new app installs from November 20 to December 2 so a delisted app cannot be added during peak. Metric: no app changes in the peak window.

Before Black Friday: app check

  • List every public app
  • Mark apps that run bulk jobs
  • Get vendor confirmation in writing
  • Watch cross-channel stock daily
  • Recheck Settings > Apps Nov 21
  • Freeze installs Nov 20 to Dec 2

When this does not apply

If your store runs only custom apps built for you, nothing is forced on you now, though an allowlist is still good practice. If every public app you use comes from a large, well staffed vendor, the risk is low, but a written confirmation still beats an assumption. And none of this affects Shopify checkout or payments directly: it governs how outside apps reach your store's data.

Where PPC Spider helps

PPC Spider is a marketplace agency for brands selling on Amazon and other marketplaces. Our Shopify DTC agency team checks the apps and integrations that connect a Shopify store to Amazon and Walmart before peak, and SpiderOS monitors stock and bids so a broken sync shows up as a stock alert, not a cancellation wave. If you sell on Amazon too, start with a free Amazon audit, and follow the Shopify ecommerce news channel for platform changes.

Sources

Get the next change before your competitors do

We send the marketplace changes that matter each week, with what to do next.

By subscribing you agree to our privacy policy. Unsubscribe any time.
Want this done for your account?

We run these playbooks on client accounts every day. Start with a free audit.

Get a free audit