Restrict Admin API access with an IP allowlist
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on October 27, 2026.
This Shopify update is categorized as Dev Dashboard, New.
What changed
Your app's Settings page has a new IP allowlist section. Enter your servers' addresses or CIDR ranges, test them against recent traffic, and enable enforcement. Requests from outside your ranges fail with a 403 status code.
Who is affected
Shopify app developers using the API or platform feature named in this update should review the official change.
What action may be needed
We strongly recommend using an IP allowlist if your app calls Shopify from static IP addresses. For setup instructions, see Restrict API access with an IP allowlist. Note: Support for apps hosted on serverless platforms with dynamic IP addresses is coming soon.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →