Two dates, different consequences
Shopify announced the requirement on November 5. At 11:59 PM Eastern on November 12, bulk operations from public apps without an IP allowlist will fail. At 11:59 PM Eastern on November 20, public apps without an allowlist will lose their App Store listing and be blocked from new installations.
Custom apps and apps created by merchants in the Dev Dashboard or admin are excluded. Developers can configure static IP addresses or CIDR ranges; dynamic hosting can use provider ASNs and the countries where the app runs.
Merchants have a new place to check
A separate November 5 update adds app activity, permissions and security information under Settings > Apps. Merchants can review expiring-token adoption and enforced IP restrictions, alongside labels for permissions that may include sensitive data.
Our recommendation is to start with apps responsible for stock, orders and scheduled catalog updates. Ask the provider whether it uses bulk operations and whether the allowlist is configured. Save the answer with the name of the person responsible for the integration.
Test the job that matters to the store
A successful login does not establish that an overnight catalog sync can finish. Before the deadline, have the integration owner run a representative job from the infrastructure that normally runs it, then check completion and error reporting.
If a provider reports a problem, agree on a temporary operating procedure before changing or uninstalling the app. Removing an integration during a busy sales period can create a second problem. Keep this deadline separate from Shopify’s previously announced offline-token migration dates.
For your next work session
What to check next
- List public apps that perform bulk imports, exports or scheduled updates.
- Ask each provider to confirm its allowlist and the applicable deadline.
- Review the app’s access and security information in Settings > Apps.
- Test representative background jobs and document an escalation contact.
Sources and scope
The requirements cover public apps. Custom apps and merchant-created apps are excluded. The November 12 consequence applies to bulk operations; the November 20 consequence is delisting and blocking new installs, not a stated shutdown of every existing API call.
The announcement is confirmed by the source below. Practical checks in this article are Stan Consulting's recommendations.
Need help applying this to your business? Ecommerce services.
