Register your server IP addresses (or CIDR ranges) in the Dev Dashboard and enable the restriction, and Shopify will reject with a 403 any GraphQL Admin API / REST Admin API request made with your app's token from anywhere else.
The API accepted the token no matter where it was used from.
Requests from outside the allowlist fail with a 403. Even if a token leaks, it can't be used from outside the allowed IPs.
203.0.113.0/24 A notation that expresses a contiguous range of addresses as "IP address + prefix length," as in the example. It lets you allow access per network rather than one server at a time.
Requests made with the app's token are checked against the allowlist.
Likewise, calls from outside the allowlist fail with a 403.
The article doesn't say whether it applies to APIs other than the Admin API, such as the Storefront API.
The article doesn't mention a limit on how many addresses you can add or whether IPv6 is supported.
The article doesn't mention which plans it's available on or whether there are extra fees.
| Item | No allowlist | Allowlist enabled |
|---|---|---|
| Where the token works | From anywhere | Only from registered IPs/CIDRs |
| Requests from outside the range | Processed as usual | 403 error |
| Impact if a token leaks | A leaked token works as-is | Unusable from outside allowed IPs |
| Where to configure | — | Dev Dashboard > your app's Settings > IP allowlist |
| Pre-rollout testing | — | Available Test your entries against recent traffic |
Shopify strongly recommends using it. If you call the API from servers with fixed IPs or through a NAT gateway, you can adopt it right away.
Support for apps hosted in serverless environments with dynamic IPs is "coming soon". For now, consider them out of scope.
Enter your server addresses or CIDR ranges in the IP allowlist on your app's Settings page in the Dev Dashboard.
Check the ranges you entered against actual recent traffic.
Once enforcement is turned on, requests from outside the allowed ranges fail with 403.
"Source IP (where you are)" is added on top of "token (what you have)". Even if a token leaks, it can't be used to call the Admin API from outside the allowlist.
Requests from outside the allowed ranges get a 403. Review your logs and alerts so your app's error handling and monitoring can tell these apart from "insufficient permissions" errors.
A test feature checks your entries against recent traffic. Use it to find easy-to-miss sources such as batch jobs, workers, and staging environments.
Serverless environments with dynamic IPs aren't supported yet. For those setups, you'll need to either move to an architecture with a fixed source IP or wait for support.
It's configured on each app's Settings page and applies to both the GraphQL Admin API and the REST Admin API when they're called with that app's tokens.Always add "update the allowlist" to your infrastructure change procedures (server migrations, NAT changes, new IPs). If you forget, every production API call will fail with 403.