What changed: Public apps that call the Admin API must turn on an IP allowlist by November 20, 2026, 11:59 PM ET, or they are delisted from the App Store with no new installs; bulk queries and mutations from public apps without an allowlist are blocked from November 12, 2026, 11:59 PM ET, and Admin API requests from non-compliant apps fail on April 1, 2027.
When: Deadline: Nov 12, 2026.
Who is affected: Shopify sellers (New plugins).
What to do: Merchants will see apps flagged in Settings > Apps after November 20, and any automation that relies on bulk ops can break on November 12 if the app vendor missed the allowlist, so check critical apps before BFCM week.
Source: Shopify.dev changelog (official)
| Marketplace | Shopify |
|---|---|
| Topic | New plugins |
| Source date | Nov 5, 2026 |
| Deadline / alert | Deadline: Nov 12, 2026 |
| Primary source | Shopify.dev changelog (official) |
| Verified in directory | Nov 9, 2026 |
Open primary sourceBack to directory
Deadline: Nov 12, 2026
Shopify sellers interested in New plugins. Merchants will see apps flagged in Settings > Apps after November 20, and any automation that relies on bulk ops can break on November 12 if the app vendor missed the allowlist, so check critical apps before BFCM week.
Shopify.dev changelog (official): https://shopify.dev/changelog/blog/app-security-updates-ip-allowlist-is-now-required
Updated Nov 9, 2026. Summaries are editorial; always confirm on the primary source before acting.