Action neededShopify · Changelog
Custom apps built for your store need a security setting before New Year
What they said
“Leaked tokens can be used from any network location.”
In plain English
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
51 days leftWhy it matters
What to do
- 1List your custom apps
- 2Ask whoever built them to set an allowlist
- 3Get existing apps done before 1 January 2027