If you've ever built a custom Shopify app for a client and installed it on their store, a deadline is coming up. On 11 November 2026 Shopify announced that custom apps installed outside the organization that owns them must have an IP allowlist, with the first deadline on 20 November.
Shopify's summary: "We're enhancing protection of merchants by requiring IP allowlists for custom apps, if those apps are installed on stores outside of the organization that owns them."
The two dates
- "Starting November 20, 2026 at 11:59 PM ET: Apps must have an IP allowlist for new installs."
- "Starting January 1, 2027 at 11:59 PM ET: Allowlists are required for existing installs."
Both times are US Eastern. US daylight saving time ends on 1 November 2026, so ET means EST, five hours behind UTC. That puts the first deadline at 04:59 UTC on 21 November, which is 09:59 in Pakistan the same morning, and the second at 04:59 UTC on 2 January 2027, which is 09:59 in Pakistan.
The clause agencies should read twice
Under "What apps are affected", Shopify lists custom apps installed outside the owning organization, and then partners who own multiple apps:
"From January 1, 2027, one app without an allowlist affects your ability to install any app on stores outside your organization."
That's the part that matters if you build for clients. It isn't only the forgotten app that has a problem: one missing allowlist affects your ability to install any of your apps outside your organization. The changelog doesn't spell out exactly how, so treat it as a reason to get every app done, not to find the minimum.
What's not affected
Shopify lists the exceptions itself:
- "Apps installed only on stores within your own organization"
- "Apps created by merchants either in the Dev Dashboard or in the admin"
- "Public apps, which are covered by a separate requirement"
So this deadline is for custom apps installed on stores outside your organization. It isn't the deadline for public App Store apps. Those have their own requirement, which this changelog doesn't describe.
Why Shopify is doing it
"Leaked tokens can be used from any network location. IP allowlists reduce the impact of a credential leak by limiting the networks from which your app can invoke the Admin API." In other words, a leaked token is limited to the listed networks when it's used to call the Admin API.
What to do
Shopify's instructions are short. You configure the allowed IPs in the Dev Dashboard. If your app calls Shopify from fixed addresses, you list those addresses or ranges. And "If your app's egress IP addresses are dynamic, allow your hosting provider's ASNs and list the countries your app runs in."
The bigger job is knowing what you've got. Shopify's own instruction: "Audit every app you've installed on stores outside your organization, and configure an allowlist on each one before January 1, 2027." For an agency, that means:
- Make the list. Every custom app you own that's installed on a client's store, including old projects you haven't touched in a while.
- Find out where each app runs. You need the addresses it calls Shopify from, or, if those change, the hosting provider and countries.
- Plan any new installs around 20 November. From then on, a new install outside your organization needs the allowlist in place.
- Finish before 1 January. Because of the clause above, one app left over can affect the rest.
Shopify points to its help page, "Restrict API access with an IP allowlist", for setup steps. Read it alongside the changelog before you start.
Source: Shopify developer changelog, "IP allowlists are now required for custom apps installed outside your organization" (11 November 2026; read 12 November 2026).