Restrict Admin API access with an IP allowlist
Source: Shopify Dev Changelog
Shopify Adds IP Allowlist for Admin API Access Tokens
Shopify now lets developers restrict Admin API access tokens to specific IP addresses. The new feature, managed through the Dev Dashboard, gives app developers a way to lock down where their app’s API requests can originate from.
What Changed
Each app’s Settings page in the Dev Dashboard now includes an IP allowlist section. Developers can enter their servers’ IP addresses or CIDR ranges to define which locations are permitted to use the app’s Admin API tokens. Before enforcing the restriction, developers can test their configured ranges against recent API traffic to confirm legitimate requests won’t be blocked. Once enforcement is enabled, both GraphQL Admin API and REST Admin API requests originating from outside the allowlisted ranges are rejected with a 403 status code.
Why This Matters
Admin API access tokens carry significant privileges, often including read and write access to store data such as orders, customers, and inventory. If a token is leaked through a compromised server, exposed environment variable, or intercepted request, it can be used from anywhere until it’s revoked. An IP allowlist adds a network-level control that limits the blast radius of a leaked token, since requests from unauthorized IPs will fail regardless of whether the token itself is valid.
Practical Implications
Developers running apps on infrastructure with dynamic or frequently changing IP addresses, such as some serverless or auto-scaling environments, will need to account for IP range changes to avoid unintentional request failures. Teams using CDNs, proxies, or load balancers should confirm which IP addresses actually reach Shopify’s API endpoints before enabling enforcement. Using the testing step against recent traffic before turning on enforcement is recommended to avoid disrupting production API calls.