Shopify news and updates

Action neededShopify · Changelog· Yesterday

Custom apps built for your store need a security setting before New Year

What they said

“Leaked tokens can be used from any network location.”

In plain English

If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.

For founders, developers
51 days leftWhy it matters
What to do
  1. 1List your custom apps
  2. 2Ask whoever built them to set an allowlist
  3. 3Get existing apps done before 1 January 2027
Don’t miss

Latest

Newest first · Last update 10 hours ago
FYIShopify

Customer data deletion requests now go through in 5 days, not 10

When a customer asks you to delete their data, Shopify now processes it 5 days after the request instead of 10. This started on 10 November 2026. The only exception is when a gift card is due to be sent to someone: then it waits until the gift card has been delivered.

Yesterday · For founders, ops
Worth knowingShopify

Apps can now open Shopify's AI assistant, Sidekick, for you

Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.

28 Oct · For founders, developers