November 2, 2026 · Muhammad Rehan · More by Muhammad Rehan
What Shopify's network_access Config Actually Does
Shopify's new network_access section in shopify.app.toml looks like a firewall. It's actually a deploy-time allow-list for monitoring and UX.
Two fields, two different jobs
Shopify's new network_access section in shopify.app.toml, shipped October 27, 2026, has exactly two properties, each capped at 20 entries. allowed_navigation_hosts lists the external sites your app links customers to from the storefront. List each host exactly as it appears in your links, and those links skip the customer-facing "you're leaving the store" warning. allowed_sources is a different list: up to 20 full HTTPS origins that your app's own code loads from or sends requests to on storefront, checkout, and admin pages — your extensions, your app home, and any HTML or Liquid app proxy pages you serve.
The two lists have different rules. allowed_navigation_hosts entries must be lowercase, with no scheme, port, path, or wildcard, and can't be IP addresses, localhost, or Shopify domains like myshopify.com — every subdomain needs its own entry. allowed_sources must be complete HTTPS origins. Both explicitly exclude anything Shopify itself already serves — a theme app extension's assets folder files don't need an entry — and allowed_sources leaves out your own app proxy URL too, since the store serves those pages from its own domain.
It's a monitor and a UX shortcut, not a gate
It's tempting to read this as an access-control firewall. It isn't one. Shopify's own framing is detection and user experience: the lists let Shopify "spot requests your app didn't make" and watch storefronts for malicious activity — they don't block an unauthorized call at request time. The one place enforcement happens is shopify app deploy: Shopify validates both lists when it creates the new app version and rejects the deploy outright if an entry breaks the formatting rules. After that, it's a static declaration Shopify checks against, not a live request filter.
A different mechanism from the IP allowlist
Shopify shipped this alongside a separate Admin API IP allowlist in the same October security push. Don't conflate the two. The IP allowlist restricts which server IPs can call the Admin API with a valid token — that's inbound access control. network_access instead declares the outbound and frontend footprint of your own app's code — what it links to and where it talks to. One guards who can call you; the other tells Shopify what your app is supposed to be doing, so it can notice when something doesn't match.
For a team integrating a Shopify app with external billing, CRM, or logistics endpoints, the practical move is straightforward: enumerate every external host your storefront links land on, and every HTTPS origin your extensions or app-proxy pages actually call, before the next deploy.