Shopify App IP Allowlists: Serverless Setup, Deadlines and 403 Verification

Shopify’s app IP allowlist requirement is an outbound API control: it limits where an app’s tokens can be used, rather than who can visit the app’s website. For public-app teams, the immediate task is to identify every backend that calls Shopify, choose an IP or network rule that matches those deployments, and prove permitted calls still work while a controlled disallowed source is rejected.

En serverless-support announcement explains why a changing outbound IP does not rule out an allowlist. Shopify now supports hosting networks identified by autonomous system number (ASN), with optional country restrictions. That broadens deployment compatibility; it does not make a shared cloud network equivalent to an individual application identity.

Use the actual phased deadlines

Shopify’s November 5, 2026 requirement notice gives separate milestones. Do not collapse them into “all API access stops November 12.” Custom apps are encouraged to configure allowlists, but the mandatory rollout is for public apps.

The first deadline is six days after this guide’s November 6 verification date. Existing installations are not an exemption from the later API cutoff or the earlier bulk-operation restriction. Treat package configuration, enforcement validation and merchant-facing availability as separate acceptance items. Recheck the official notice before a later rollout; its calendar is not a guarantee that an unrelated API error is caused by this requirement.

Identify which request path is covered

En allowlist documentation applies source checks to app-token GraphQL and REST Admin API requests. It excludes dev-preview requests on dev stores and embedded direct API access. Flow’s Send HTTP request action and Oxygen-hosted storefront Admin API calls are incompatible with this allowlist because Shopify cannot verify their source. Inventory those paths explicitly instead of assuming every Shopify-related request has the same behavior.

A browser’s IP, a developer laptop and a background worker may all differ from the outbound identity Shopify sees. Map the request issuer to its deployment: the web backend, a queue consumer, a scheduled job, a separate region, a disaster-recovery environment or an integration service. Record the app, intended shop, credential reference, API operation, deployment revision and observed egress. Use a reference to a token held in the approved secret store, never the token value in a spreadsheet.

Shopify’s API-client log guidance describes 30 days of request records, including shop, client IP and user agent. Correlate those observations with your deployment inventory. A quiet backup region or month-end job might not appear in recent traffic, so a clean sample does not prove complete coverage. A user agent is useful context, not a trusted workload identity.

Choose the narrowest workable egress rule

For fixed outbound addresses, Shopify recommends IP rules. On dynamic serverless hosting, ASN rules avoid maintaining an individual address list. Country filters use the source-IP geolocation data Shopify consults, rather than the provider’s registered country. If Shopify cannot determine the required source information, it rejects the request. Shared-provider network access remains broader than a dedicated egress address.

Ask the hosting owner which public egress paths the app actually uses. Consider IPv4, IPv6, NAT gateways, regional failover and any proxy that terminates the connection to Shopify. A list of inbound addresses for your website is not an outbound egress inventory. Do not copy a provider’s entire global address estate as a convenience or assume one successful function invocation represents every region.

If you select ASN mode, compare provider documentation with observed client addresses, then confirm the corresponding network and country choices. One provider can operate several networks; a migration can change the path. Decide who reviews those changes before deploying a new region. When dedicated egress is operationally available, compare its narrower scope against the cost and availability requirements rather than treating the largest allowlist as the safest one.

Test the proposed configuration before enforcement

In the app’s Dev Dashboard, use Settings → IP allowlist → Manage. Choose IP addresses or Networks (ASN), enter the intended rules, and run the recent-traffic test before enabling Enforcement and saving. The documentation’s test covers 30 days and may lag the newest requests by minutes. Resolve expected blocks before treating the configuration as ready.

Export or record a restricted baseline of the current settings, expected egress and service owners. Keep the rollout reversible through the approved change process, with one person able to diagnose a blocked business-critical worker. This is a controlled platform configuration change, not a reason to remove app authentication, expand token scopes or distribute a production token to extra machines.

For verification, use an owned test shop and app with a confirmed non-exempt backend request path. Start with a known, read-only Admin API operation already present in your approved test harness. Keep app identity, token reference, shop, API version and operation constant while changing only the controlled source. Do not use a storefront, embedded direct call or dev-preview exception as the negative control.

Investigate a 403 without weakening the policy

The allowlist documentation specifies HTTP 403 for disallowed or unverifiable sources, but that status alone does not identify the cause. First confirm which host returned it and whether the request reached the intended Shopify API. Preserve a sanitized error response, timestamp and available correlation identifier. Avoid recording authorization headers, cookies, full GraphQL bodies containing customer data or secrets embedded in URLs.

Compare the observed client IP with the active deployment’s expected source and the saved allowlist. Check whether the caller moved region, used IPv6, crossed a different NAT or proxy, or belongs to a documented incompatible path. In ASN mode, inspect both the network and country conditions. A laptop request that succeeds says little about a blocked queue worker; a failed credential control says little about egress.

If an expected issuer was omitted, correct the smallest necessary rule and rerun both the permitted and disallowed controls. If the proposed explanation cannot be corroborated, retain an unresolved incident rather than globally opening the rule. Retrying a blocked write repeatedly may also obscure the business outcome; preserve the original operation and reconcile it through the application’s normal idempotency and support workflow.

An allowed network does not authorize the app’s own users

Shopify’s API-log guide cautions that an attacker can cause calls through an unauthenticated endpoint on your own backend, leaving a familiar source address. An egress allowlist cannot decide whether a tenant was entitled to ask your backend for that operation. Audit the user-to-app permission and the app-to-Shopify token boundary separately.

For that separate application check, scope one synthetic shop-owned record and two test identities to a single read-only route. If you evaluate the workflow with Penligente, plan for client installation, registration and explicit authorization. Confirm identity handling and target reachability before the task; the app owner configures Shopify’s allowlist. The general product demonstration is not evidence of a Shopify integration, serverless egress check or completed test.

Method: AI-assisted primary-source research and an original validation plan, checked November 6, 2026. No Shopify settings, API requests, live credentials or Penligent task were tested or changed for this article.