Shopify updates week 45: IP allowlist mandatory for apps

Shopify updates week 45 2026

A quiet week in the Shopify changelog, but with an update you won't want to miss: public apps will soon be required to have an IP allowlist, or they will be removed from the Shopify App Store. In addition, Track with Shop is expanding to Japan and Singapore, and agencies and app developers are getting a new way to test network settings.

IP allowlist required for public apps

What has changed? Shopify is making an IP allowlist mandatory for all public apps that use the Admin API. With an allowlist, an app specifies which IP addresses or networks it can communicate with your store from. Requests from outside that list will be rejected. Apps that use bulk operations must have configured the allowlist by November 12, 2026 at the latest; after that, bulk actions from apps without an allowlist will fail. All other public apps must do so by November 20, 2026 at the latest. Apps that do not meet this deadline will be removed from the Shopify App Store, can no longer be newly installed, and will be flagged in your admin under Settings > Apps. Existing installations will continue to work for now: from January 15, 2027, you will see a warning in your admin, and from April 1, 2027, Admin API requests from such apps will fail.

Who is this for? All public apps, and therefore any store that uses such apps. According to Shopify, custom apps and apps you created yourself in the Dev Dashboard or in your admin are not included.

What do you need to do? As a store owner, you do not need to configure anything yourself; the app developer handles the allowlist. After November 20, check under Settings > Apps to see which apps are flagged. If you see an app there that is important for your orders, inventory, or feeds, contact the developer and ask when it will meet the requirements. This will give you plenty of time to find an alternative before April 2027.

Want your app stack reviewed? Many online stores run ten or twenty apps, and it is not always clear which of them are business-critical. A specialist can walk through with you which apps are affected, what happens if a connection fails, and which replacement is suitable. That is what we do at HNTR Concepts, for example, in our consultancy as a watchdog. View the rates or contact us.

Track with Shop now also in Japan and Singapore

What has changed? Buyers with a shipping address in Japan or Singapore now have the option to track their order with the Shop app. If your store is eligible and Track with Shop is enabled, these buyers will see a Track with Shop button on your thank-you page, your order status page, and in order emails. In addition, Shop is now also available in Japanese, in the Shop app and on Shop.com.

Who is this for? Stores that sell to Japan or Singapore and have enabled Track with Shop.

What do you need to do? If you sell to one of these countries, check your settings to see if Track with Shop is enabled. Nothing changes for other countries. Are you preparing your store to sell outside Europe? Then read more about internationalizing your Shopify store.

Test app network access on development stores

What has changed? App developers can use the network_access_testing feature preview on a development store to test whether their network settings are correct. Links to domains that are not allowed will show a warning when leaving the site, and the browser console will report it as a storefront page loading something from a server that is not on the list. The preview only warns and does not block anything.

Who is this for? Developers and agencies that build apps. Shopify recommends that all apps configure these settings so that store visitors do not see unnecessary warnings when navigating.

What do you need to do? If you are having a custom app or custom integration built, ask your developer whether the network settings have already been tested. This will prevent customers from seeing warnings in your store later.

Also new this week

  • IP allowlist via networks (ASNs): apps on serverless hosting with changing IP addresses can now allow networks (ASNs) in the allowlist instead of individual IP addresses, with a maximum of 10 ASNs and 10 countries.
  • More languages in UI extensions: the 256 KB limit for all language files of a UI extension combined has been removed. Apps can therefore include more translations; the limit of 30 KB per individual language file still applies. You do not need to do anything yourself.

Need help?

Want to know which apps in your store are affected by the new security requirements, or do you want to prepare your store for selling abroad? HNTR Concepts is happy to help you as a Shopify Growth Partner. View our services and rates, or contact us.

Sources