If you run a Shopify store with installed apps, your admin now shows how securely each app connects to your store. Shopify is also tightening the rules for public apps this month, so this is a good week to check which of your apps meet the new standard and which may be flagged.
What changed
On 5 November 2026, Shopify added more detail to the apps area of the admin. In Settings > Apps, the list of installed apps now shows when each app was last active and points out any security problems. Open an app to see its access, permissions and recent activity in one place. Permissions that may include sensitive data are labelled, so you can spot them without reading through every scope.
The security measures shown include:
- Expiring access tokens. The app's credentials expire and have to be renewed regularly. That limits how long a stolen token could be used.
- Enforced IP restrictions. The app can only call Shopify's API from approved IP addresses. Shopify's developer changelog puts it this way: with an allowlist, "a leaked token can't be used anywhere but your own servers."
Behind this view are two new requirements for app developers, announced on Shopify's developer changelog:
- IP allowlist. Every public app that calls the Admin API must turn on an IP allowlist by 20 November 2026 (11:59 PM ET). Apps that use bulk operations, a way of reading or updating large amounts of store data in one job, have an earlier deadline of 12 November 2026.
- Expiring offline access tokens. Public apps still using tokens that never expire must move to expiring tokens before 1 January 2027.
Who it affects
The rules apply to public apps. They do not apply to custom apps, or to apps a merchant creates in the Dev Dashboard or in the admin. If an agency or freelancer set up an integration for your store as a custom app, it is outside these specific rules, although the same security ideas are still good practice.
For store owners, the effect is indirect but real. You don't configure allowlists or tokens yourself; your app developers do. What you see is the result:
- Apps that miss the deadlines get flagged in your Settings > Apps page.
- Non-compliant apps are removed from the App Store and blocked from new installs. If you uninstall one, you could find you can't install it again until the developer fixes it.
- From mid-January, you will see warnings in your admin about apps at risk of service interruption.
- From 1 April 2027, Admin API requests from non-compliant apps fail. An app that still hasn't fixed things by then can stop syncing orders, stock, prices or customer data.
This matters most for stores that depend on a handful of apps for daily operations: ERP and inventory connectors, shipping and fulfilment tools, accounting exports, marketplace feeds and reviews. It also matters if you have just moved to Shopify. A [migration](/migrate-to-shopify) usually means installing a new set of apps in a short time, and some of them may come from smaller developers who are still catching up.
What to do now
- Open Settings > Apps. Look at the apps index and note any app with a highlighted security issue.
- Open each business-critical app. On its details page, check the access and permissions section. Pay attention to permissions labelled as possibly including sensitive data, and ask yourself whether the app needs them for what it does for you.
- Remove what you don't use. Uninstall apps you tested once, apps that duplicate each other, and apps left over from a previous agency or platform move. Before you uninstall, check whether the app added anything to your theme or stores data you need, and export that data first.
- Contact the developers of flagged apps. First check the app's details page, which shows its security setup. Then ask the developer two direct questions: have they enabled an IP allowlist, and have they moved to expiring offline access tokens? Ask for a date if the answer is no.
- Plan a replacement for any critical app without a clear answer. Most Admin API requests keep working until 1 April 2027. But an app that uses bulk operations without an IP allowlist loses them after 12 November 2026, so ask inventory, ERP and feed apps about this first. Finding, testing and switching to another app takes time, especially for anything that touches orders, stock or accounting.
- Recheck after 20 November. Shopify says apps without an IP allowlist are flagged in Settings > Apps after that date, so the view will be more complete then.
- Ask about custom integrations. Even though custom apps are excluded, ask whoever maintains them how their access tokens are stored and whether access is limited to known servers.
If an app handles customer data and you sell in the EU or UK, your privacy obligations as a store owner don't change with this update. If you are unsure whether an app's access fits your privacy policy or data processing agreements, check with your legal adviser.
Deadlines and dates
These dates come from Shopify's changelogs. The 12 and 20 November deadlines are 11:59 PM ET; Shopify gives no time for the other dates.
- 5 November 2026: App security information added to Settings > Apps.
- 12 November 2026: Bulk operations from public apps without an IP allowlist stop working.
- 20 November 2026: Public apps without an IP allowlist are delisted from the App Store, blocked from new installs and flagged in Settings > Apps.
- 1 January 2027: Public apps still on non-expiring offline tokens are delisted, blocked from new installs and flagged in Settings > Apps.
- 15 January 2027: Merchants see admin warnings about non-compliant apps.
- 1 April 2027: Admin API requests from non-compliant apps fail. Until then, existing installs keep working, apart from bulk operations, which are blocked from 12 November for apps without an IP allowlist.
Make it a routine, not a one-off
App audits are easy to forget once a store is live. Put a reminder in your calendar to look at Settings > Apps every quarter, and add it to your checklist whenever you add a new market, launch a new sales channel or replace a back-office system. The new view puts the information you need in one place.
Planning a move to Shopify or selling in more countries? [Talk to Veriqo](/contact) about getting your app stack right from day one, or read our guide to [selling in Europe](/shopify-europe).