The Shopify IP allowlist stopped being optional on November 5, 2026. Every public app that calls the Admin API now has to restrict its tokens to known networks, with two hard dates: November 12 for apps that run bulk operations and November 20 for everyone else. Shopify gives you two ways to comply, a list of static IPs or a list of hosting networks by ASN, and they are not equally strong. If you build or maintain a public app, pick the static route where you can and treat ASN as the fallback it is.
What Shopify changed between November 5 and November 6
Shopify turned the IP allowlist it recommended on October 27 into a requirement for all public apps, and in the same week put bulk operations behind an explicit access switch. The November app security update sets the schedule. After November 12, 2026 at 11:59 PM Eastern, bulk queries and bulk mutations from a public app without an allowlist are blocked. After November 20 at 11:59 PM Eastern, a public app without one is delisted from the App Store and blocked from new installs, and merchants see it flagged under Settings, then Apps. Stores that already have such an app keep using it until April 1, 2027, the same cutoff as expiring offline tokens.
Custom apps and apps a merchant creates in the admin or the Dev Dashboard are outside the allowlist requirement. Apps that call the Admin API from merchant infrastructure can ask Shopify for an extension, but the expectation is that they move.
When we wrote about expiring offline tokens vs the IP allowlist two weeks ago, allowlisting for serverless hosting was still on the roadmap. It shipped this week, and that changes the compliance math.
Static IP vs ASN allowlist: which one actually protects a token
A static IP allowlist limits a leaked token to machines you control, while an ASN allowlist limits it to machines your cloud provider controls, which is a much larger group. Per the ASN support changelog, the Dev Dashboard now accepts either IP addresses and CIDR ranges, or up to 10 ASNs restricted to up to 10 countries. You test either list against recent traffic, then enforce it, and calls from outside the list return a 403.
An autonomous system number identifies a network operator, not a customer. When you allow your serverless provider's ASN, you allow every function, container and rented virtual machine on that provider in the countries you listed. An attacker holding your token only needs an account on the same cloud in the same region to pass the check. The country filter narrows it, and it still blocks the residential proxies and random VPS hosts that most token abuse comes from. That is real value. It is not the same guarantee as "only our servers".
Our ranking for public apps is short. Static egress first: a NAT gateway or a small fixed egress proxy in front of the functions that call the Admin API, with two or three addresses on the allowlist. ASN second, for teams that cannot change hosting before November 20. Both beat having no list at all, which from next week stops being a choice.
The cost of static egress is usually a few dollars a month and one afternoon of network config. Only the calls to Shopify need to go through it. Storefront traffic, webhooks coming in and calls to other services can stay on the default path.
The bulk operations switch and its 31 day trap
Since November 6, a partner built app needs bulk queries and bulk mutations enabled separately in the Partner Dashboard before bulkOperationRunQuery or bulkOperationRunMutation will run. The bulk operations changelog says apps already using them were switched on automatically, and that the rule covers every Admin API version. Unlike the allowlist, it also covers custom apps that a partner builds, not only public ones.
The detail worth a calendar reminder is the inactivity rule. If 31 days pass without the app starting a bulk query, it loses bulk query access, the same clock runs separately for mutations, and the next call fails with access denied. Daily catalog syncs will never notice. A quarterly price import, a yearly full order export for the accountants, or a reindex you only run after a platform migration will, and they tend to run at the worst possible moment.
The same post announces that bulk queries and bulk mutations will each get their own access scope. Shopify will grant them automatically to any app with bulk activity in the past 180 days, but you will still need to add them to the app config before the next deploy once Shopify publishes the names.
Bulk operations are also the workhorse of the integrations we build in back office automation: catalog exports to a PIM, order history into a data warehouse, mass inventory corrections from an ERP. Most of those run as custom apps and escape the allowlist deadline. They do not escape the 31 day rule if a partner built them, and they still hold the broadest scopes on the store.
What we would do before November 12
Start with an inventory of every app that calls bulk operations, because that group has the earliest deadline and the narrowest margin. For each public app you own, put the Shopify calls behind static egress if the hosting allows it, add the addresses, run the dry test against the last few days of traffic, and enforce. If static egress cannot land in a week, enable ASN with the tightest country list your infrastructure allows and schedule the move to static for January.
For custom and partner built apps, check the Partner Dashboard for both bulk switches, and add a monthly no op bulk query to any integration whose real jobs run less often than every 31 days. Turn on the allowlist there too. It is not required, but those apps carry the most powerful tokens on the store.
The merchant sees the result first, because the Settings, then Apps screen now shows each installed app's token type and allowlist status. From November 21, an app missing the allowlist carries a visible flag on the store it is installed in. On a Shopify Plus build with ten or fifteen apps, that screen becomes a vendor audit nobody scheduled.
For merchants, open Settings, then Apps, this week and send every flagged vendor one question: when will your IP allowlist be on? Anything still flagged on November 21 cannot be reinstalled from the App Store if you remove it during the holiday rush.