On November 5, 2026, Shopify told app developers that every public app calling its Admin API must turn on an IP allowlist by November 20. The Admin API is the application programming interface (API) apps use to read and change store data, and an IP allowlist limits that access to the internet protocol (IP) addresses a developer registers.
On October 27, Shopify set January 1, 2027 as the deadline for public apps to move to access tokens that expire.
A Shopify store with a full commerce stack has an app or integration for most jobs, from reviews and subscriptions to shipping and inventory, and each one holds a key to the store. That makes the new rules worth understanding even if you never write a line of code.
What did Shopify change for app security?
Shopify’s new app security rules require every public app to use a Shopify IP allowlist and access tokens that expire. Together, the two rules mean a stolen app token stops working anywhere except the developer’s own infrastructure, and stops working altogether once it expires.
“An IP allowlist means a leaked token can’t be used anywhere but your own servers.” (Shopify developer forum)
Shopify’s November 5 post lists the dates:
- November 12, 2026. After this date, bulk queries and mutations from public apps without an IP allowlist are blocked.
- November 20, 2026. Every public app that calls the Admin API must have its IP allowlist turned on. Apps without one are delisted from the Shopify App Store, blocked from new installs and flagged in merchants’ Settings > Apps.
- January 1, 2027. Public apps must use expiring offline access tokens. Apps that haven’t moved are delisted, blocked from new installs and flagged in Settings > Apps.
- January 15, 2027. Merchants see a warning in Shopify admin for any app that still lacks an IP allowlist or uses non-expiring tokens.
- April 1, 2027. Admin API requests fail for apps that miss either requirement. Existing installs keep working until then.
Why is Shopify tightening app security now?
Shopify gives two reasons for tightening app security now: more attacks across the app ecosystem and the holiday peak. Its October 20 post says Shopify, like the rest of the industry, is seeing attacks increase as AI gets better at finding vulnerabilities. Its November 5 post asks for the IP allowlist now because merchants’ busiest weeks of the year are almost here.
What can a connected app change in your orders?
A connected app can change whatever its credential allows, and an app that syncs orders or inventory holds a credential that can read and update both.
In the wrong hands, that credential could alter a shipping address, cancel an order, or push the wrong stock level to every channel you sell on. The damage shows up later as missed shipments, oversold items and customers asking where their order went.
Homegrown integrations deserve a second look. A script or custom app that holds a store credential isn’t required to meet Shopify’s new public-app rules, which leaves IP restriction, credential rotation and monitoring to your own team. A managed connector moves that work to a vendor that maintains the connection and its security as platform rules change.
What should brands ask their app and integration vendors?
Brands should ask every app and integration vendor connected to their store whether it meets Shopify’s new requirements and how it protects the store’s credentials. Ask for answers that are specific and dated.
- Is your Shopify app on an IP allowlist, and will you meet the November 20 deadline?
- Have you moved to expiring access tokens, and if not, will you before January 1, 2027?
- Where are our store credentials stored, how are they encrypted, and who can use them?
- Which access scopes do you request, and why does your app need each one?
- Do you hold a System and Organization Controls (SOC) 2 Type II report, and will you share it under NDA?
- How quickly will you tell us about a security incident that affects our store?
Then remove the apps you no longer use. Every app with access to your store should be one you chose to keep.
How does Pipe17 keep your store connections secure?
Pipe17 keeps store connections secure by having already met both of Shopify’s new requirements, encrypting and monitoring the credentials it holds, and putting its platform through SOC 2 Type II audits. As the order management system that connects your storefronts, marketplaces, warehouses and enterprise resource planning (ERP) system, Pipe17 runs those order and inventory connections for you instead of a separate script or connector for each system.
- IP allowlist in place. Shopify accepts calls made with Pipe17’s store tokens only from Pipe17’s own cloud infrastructure, so a token copied from Pipe17 is rejected anywhere else.
- Expiring access tokens. Pipe17’s Shopify integration already uses expiring access tokens, ahead of Shopify’s January 1, 2027 deadline.
- Protected credentials. Data is encrypted at rest and in transit, and credentials for connected systems are stored with 256-bit encryption in a dedicated secrets manager, never displayed again after entry, never written to logs, and can be rotated or revoked at any time.
- Monitored continuously. Pipe17 runs 24/7 security monitoring with automated alerting, including alerts if Shopify ever rejects a Pipe17 call.
- SOC 2 Type II. Pipe17 holds a SOC 2 Type II report covering security, availability and confidentiality, and outside firms run penetration tests on the platform every year.
- Sign-in controls. Enterprise single sign-on and multi-factor authentication protect access to the platform.
The larger benefit is fewer key holders for your order data, each held to the same standard. When one platform maintains your connectors to Shopify, marketplaces, third-party logistics providers (3PLs) and your ERP, the credentials behind your order and inventory flows sit with one audited vendor instead of many. The Pipe17 Trust Center has the full detail, including how Pipe17 notifies customers of a security incident.
Frequently asked questions
Do custom Shopify apps have to meet the new rules?
Shopify’s new deadlines apply to public apps, and custom apps aren’t required to meet them. Shopify’s changelog says the expiring-token rule excludes custom apps and merchant-created apps, and Shopify’s November 5 post addresses the IP allowlist requirement to public apps that call the Admin API. A brand that runs a homegrown integration should add IP restriction, credential rotation and monitoring itself, because none of Shopify’s announced deadlines requires them.
How can a brand check whether its Shopify apps meet the new rules?
Brands can check in Shopify admin under Settings > Apps, which now shows whether each installed app uses expiring tokens and an IP allowlist, according to Shopify’s November 5 post. After November 20, apps without an IP allowlist are flagged there. For custom apps and homegrown integrations, put the same vendor questions to your own team.
Does Pipe17’s Shopify integration meet Shopify’s new security requirements?
Pipe17’s Shopify integration meets both of Shopify’s new app security requirements. Shopify accepts calls made with Pipe17’s store tokens only from Pipe17’s own cloud infrastructure, and the integration already uses expiring access tokens ahead of the January 1, 2027 deadline.
