Prepared by the Nadali editorial team using AI.
On 27 October, Shopify announced an IP allowlist for apps: approved addresses from which their tokens can call the GraphQL Admin API and REST Admin API. Once enforcement is enabled, requests from other addresses receive a 403 error.
Who benefits
Store owners with in-house or commissioned integrations, including AI automations. This is a developer control, not a switch securing the entire store. The practical question for a contractor is: can we restrict where our integration calls Shopify from?
Check compatibility first
The documentation requires static public IP addresses. Support for dynamic serverless addresses is only planned. Token-based requests through Shopify Flow’s Send HTTP request action, and GraphQL Admin API requests from an Oxygen storefront, are incompatible with this restriction. Direct API access from embedded app pages and dev-preview requests on development stores are not blocked by this mechanism.
Developers can test the list against the previous 30 days of traffic before enabling it. That does not guarantee coverage of future infrastructure changes.
What to ask the responsible person
Our editorial recommendation: start with one integration, assign an owner and agree a change window. Ask for a list of dependent business workflows and check them after configuration. Do not enable the restriction blindly while the store is busy.
A planning example, not a test result: if an integration sends orders to a warehouse, verify that an order arrives successfully—not just that a setting was saved. Separate access decisions from evidence of completion, as in our access-review guide.
Bottom line: discuss the new control with your developer, but establish compatibility first. Nadali checked the primary sources on 27 October 2026; the editorial team did not test the setting on a live store.
