Shopify public-app developers have two approaching IP allowlist deadlines. The 5 November announcement requires configuration by 12 November for public apps using bulk operations, and 20 November for other public apps. Both enforcement points are at 11:59 PM Eastern Time on the stated date.
Shopify says bulk operations from affected apps without an allowlist will fail after the first deadline. After the second, public apps without one will be delisted and blocked from new installs. Custom apps and apps created by merchants in the Dev Dashboard or admin are outside this announcement’s scope.
Confirm which application you operate
Before changing settings, identify the app, its owner and whether it uses bulk operations. A retailer may depend on a public app maintained by a supplier while also running a separate merchant-created integration. Our recommendation is to keep those records distinct.
If a supplier owns the public app, ask for its readiness status and the functions your shop relies on. A merchant can’t establish a supplier’s deployment readiness from the app’s name alone. Record the reply alongside the relevant service contact.
Map the networks making API calls
Shopify directs apps with static egress addresses to configure IPs or CIDR ranges. For dynamic addresses, its announcement points to hosting-provider ASNs and the countries where the app runs.
Our suggested preparation is an inventory of each environment that calls the Admin API. Include background jobs and disaster-recovery infrastructure in the discussion with the developer. Compare the proposed configuration with the deployed architecture before saving it.
Test the work the merchant depends on
Choose representative operations with the app owner. For a bulk-operation app, confirm that the test actually exercises that path. A successful dashboard login doesn’t demonstrate that an unattended import can complete.
Keep a record of the environment, time and observed result, with credentials removed. If an operation fails, preserve the error and ask the owner to identify its cause before widening the network rules. Avoid treating a broad allowlist as the default response to an unexplained fault.
Keep configuration separate from token handling
The announcement describes allowlists as a way to limit where a leaked token can be used. Our recommendation is to retain the existing credential-handling controls alongside that network restriction. Document who can change the list and how hosting changes reach that person.
For integration teams, the Shopify sync-checkpoint article covers a related operational test: whether repeated data runs preserve the intended boundaries. Review each change against its own failure mode. Finish this deadline check with a named app owner, a tested configuration and a record of any environments still unverified.
Author
