Custom apps built for your store need a security setting before New Year
What they said
Read the original ↗“Leaked tokens can be used from any network location.”
In plain English
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
Why it matters
If a custom app's access key ever leaks, an allowlist stops anyone else using it. Apps without one could stop being allowed after the deadline.
What to do
- 1List your custom appsYou
Make a list of any custom apps an agency or freelancer built for your store. Apps your own team created in your Shopify admin aren't affected.
- 2Ask whoever built them to set an allowlistYour developer
Each custom app needs an IP allowlist: the networks it's allowed to connect from. New installs need one from 20 November 2026.
- 3Get existing apps done before 1 January 2027Your developer
Existing custom apps need their allowlist in place by 1 January 2027, or they could stop being allowed.
- 4Test after the changeYour developer
Once the allowlist is set, check the app still works as expected, such as stock syncs, order exports and integrations.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.