3 stories about Security
Show allShopify and online storesShopify developersApps must move to expiring access tokens by January 2027Apps must switch to expiring access tokens by January 1, 2027. Store owners need not act now, but may see an admin warning about an unmigrated app from January 15, 2027.
Shopify and online storesShopify developersPublic Shopify apps must turn on an IP allowlist by November 2026Public apps that call the Admin API must limit token use to servers they list, by November 20, or November 12 for bulk operations. After November 20, apps without it will be flagged in Settings > Apps.
Shopify and online storesShopifyShopify asks app developers to tighten security this weekShopify is asking app developers to run a new security check and start moving to short-lived access tokens. Merchants should expect apps to get stricter about how they handle store data.
Shopify and online storesShopify developersPublic Shopify apps must turn on an IP allowlist by November 2026Public apps that call the Admin API must limit token use to servers they list, by November 20, or November 12 for bulk operations. After November 20, apps without it will be flagged in Settings > Apps.Shopify and online storesShopifyShopify asks app developers to tighten security this weekShopify is asking app developers to run a new security check and start moving to short-lived access tokens. Merchants should expect apps to get stricter about how they handle store data.