November 1, 2026 · Muhammad Rehan · More by Muhammad Rehan
Shopify's IP Allowlist: What It Actually Locks Down
Shopify's new IP allowlist blocks Admin API requests from unlisted servers, but it can't cover Flow's HTTP action, Oxygen storefronts, or serverless hosts.
On October 27, 2026, Shopify shipped a new IP allowlist for the Admin API, part of a broader app-security bundle that also includes client-credentials token recovery and a new network_access declaration in shopify.app.toml. For integrators who manage their own app's Admin API tokens, it's a meaningful new boundary, but only if you understand exactly where that boundary sits.
What the Allowlist Actually Checks
Here's what the allowlist actually checks. Once enforcement is turned on, Shopify inspects the source IP address of every GraphQL Admin API and REST Admin API request made with your app's tokens. A request from outside your listed ranges fails with an HTTP 403, and so does a request whose source address Shopify simply can't confirm. A stolen token stops being useful the moment it leaves your own infrastructure, which is the point.
Setting It Up
Setting it up is straightforward. In your app's Dev Dashboard settings, you can enter up to 100 addresses or CIDR ranges, using /16 or narrower for IPv4 and /32 or narrower for IPv6. Addresses must be public; if your servers sit behind a NAT gateway, you list the gateway's address instead. Before flipping enforcement on, run the built-in test against the last 30 days of traffic to catch any of your own addresses that would get blocked, adjust as needed, then enable enforcement and confirm a request from outside your ranges actually returns a 403.
Where It Doesn't Reach
The gaps matter as much as the coverage. Three categories of requests can't be protected by this allowlist, and Shopify rejects all three outright rather than silently letting them through: apps hosted on platforms with dynamic IP addresses, such as most serverless hosts, since Shopify can't pin down a fixed source address for them (support for this is coming, but isn't here yet); access tokens used by Shopify Flow's Send HTTP request action, because Shopify can't confirm the source IP of those outbound calls; and GraphQL Admin API requests made from a storefront hosted on Oxygen, for the same reason. None of these are edge cases you can configure around today, they're flatly unsupported.
What This Means for ERP, PIM, 3PL, and CRM Integrations
For the kind of integration most teams building against ERPs, PIMs, 3PLs, or CRMs actually run (a backend job on a fixed set of servers, syncing orders or inventory on a cron schedule), the allowlist is a clean fit, and worth pairing with Shopify's separately mandated move to expiring offline access tokens, required by January 1, 2027, with non-expiring tokens starting to return 403s on Admin API calls from April 1, 2027. But if any piece of your integration routes through a Flow HTTP action, or your storefront is an Oxygen-hosted headless build calling the Admin API directly, that piece needs its own mitigation. Treat the IP allowlist as what it is: a strong control for your static backend, not a blanket guarantee across every path a token could travel.