Action neededShopify · Changelog· Yesterday
What they said
“Leaked tokens can be used from any network location.”
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
Latest
Newest first · Last update 10 hours agoFYIShopify
When a customer asks you to delete their data, Shopify now processes it 5 days after the request instead of 10. This started on 10 November 2026. The only exception is when a gift card is due to be sent to someone: then it waits until the gift card has been delivered.
Yesterday · For founders, ops
Action neededShopify
AI agents can look up a store's policies and FAQs (delivery, returns and so on) through a Shopify tool. That tool is being replaced by a new one called ask_business, which gives back a written answer. The old one stops being supported after 15 January 2027.
Yesterday · For developers65 days left
Worth knowingShopify
Apps inside your Shopify admin can now open Sidekick, Shopify's built-in AI assistant, with a question already filled in. For example, an app could add an "Ask Sidekick" button next to a report, so you get help understanding it without leaving the app.
28 Oct · For founders, developers