Developer Changelog / App configuration & security

New in shopify.app.toml: [network_access]
Declare your app's external link destinations and network endpoints

Declare the hosts you link to, and customers can skip the warning when leaving the store. Declare the servers your app talks to, and Shopify can use them to spot suspicious traffic and protect your app.

On this page
  1. What's changing (30-second overview)
  2. How it works: what the two properties do
  3. Property comparison
  4. Configuration example
  5. Which apps this applies to
  6. How to adopt it (3 steps)
  7. 5 key points for developers
  8. 3 practical use cases
  9. One-line summary for proposals

1What's changing

shopify.app.toml A new [network_access] sectionhas been added to
Apps can now declare where they link customers and which hosts their code communicates with,improving customer experience (no more warnings)andsecurity (monitoring for suspicious traffic)at the same time.

Before: warnings on links leaving the store

When a customer tries to navigate to a URL outside the store, Shopify normally shows a warning. This happened even for trusted destinations like the app's own site, adding friction to the customer journey.

Now: declared hosts skip the warning

Links to declared external hosts skip the warning. If you also declare the servers your app communicates with, Shopify uses them to detect suspicious activity and protect your app.

2How it works: what the two properties do

Where your app's code runs Storefront Checkout Shopify admin Extensions / App home / including app proxy pages Customer follows a link allowed_navigation_hosts Example: app.example.com Host exactly as written in the link Up to 20 Skips the leave-site warning Loads / sends requests allowed_sources e.g., https://api.app.example.com HTTPS origins (APIs, CDNs, etc.) Up to 20 App protection & malicious request monitoring
The two serve different purposes.navigation_hosts = where customers go(reduces friction in the experience),sources = where your code connects(used by Shopify to monitor for malicious requests on the storefront).

3Property comparison

Itemallowed_navigation_hostsallowed_sources
What to list External sites your app links to from the storefront (e.g., your own domain) Servers your app's code loads from or sends requests to (e.g., APIs, CDNs)
Format Hostname Exactly as it appears in the link HTTPS origin https:// included
Limit 20 20
Applies to Storefront Storefront / checkout / Shopify admin (including extension, app home, and app proxy pages)
Effect UX Skips the warning when navigating to external sites Security App protection & malicious request monitoring
Wildcards Not specified Not specified

4Example configuration

[network_access]
allowed_navigation_hosts = ["app.example.com"]
allowed_sources = ["https://api.app.example.com"]
navigation

Host without a scheme

app.example.com Write the host in this form, matching exactly how it appears in the link.

sources

Origin with https://

https://api.app.example.com — write them as HTTPS origins like this.

5Apps affected

Storefront
Apps with external links or outbound requests
Checkout
Apps that make outbound requests in checkout
Shopify admin
Apps that make outbound requests from the app home, etc.
The article frames the new sections as "available""strongly recommended". Any deadline, and whether undeclared requests will be blocked, isnot stated.

6How to adopt (3 steps)

1

Add link destination hosts

Add the hosts you send customers to via links, such as your app's own site, to allowed_navigation_hosts .

2

Add request destination servers

Add the destinations your code loads from or sends requests to, such as APIs and CDNs, to allowed_sources .

3

Deploy and release

shopify app deploy — run it, then release the new version.

For concrete examples, see the official docs "Declare your app's network access" (linked from the article).

75 key points for developers

host https

1. The two formats are different

navigation takeshosts(e.g. app.example.com), while sources takes HTTPS origins(e.g. https://api.app.example.com). Add this to your review checklist so the two don't get mixed up.

20

2. Each is capped at 20 entries

Apps with many external domains will need to audit and consolidate them. Whether wildcards are supported is not stated.

3. sources has a broad scope

It covers not only the storefront but also checkout and the admin, plus requests fromextension / app home / app proxypages.

4. Changes take effect on deploy + release

Writing the TOML alone isn't enough.shopify app deploy to create and release a new version — both steps are required.

?

5. The article doesn't say what happens if you don't declare hosts

There's no mention of undeclared traffic being blocked or of this becoming mandatory later. For now, it's "strongly recommended." However, the sources areused to monitor for malicious requests, so any omissions leave less to go on when telling legitimate traffic from suspicious traffic. Listing every host is the safe choice.

83 practical use cases for your business

Store
USE CASE 1

Remove the "leaving Shopify" warning when linking to a member portal or booking site

Challenge
When your storefront app links to your own member portal or booking page, Shopify shows an external navigation warning, which worries customers and causes drop-off.
Action
Declare the destination hosts in allowed_navigation_hosts , then deploy + release.
Impact
The warning disappears for trusted paths, reducing friction during navigation.
Tech note
Write hosts exactly as they appear in your links. If you have multiple subdomains, list each one separately (up to 20).
≤ 20
USE CASE 2

Inventory and declare your app's external endpoints

Challenge
Theme extensions, checkout extensions, app proxies, and the app home each call different APIs/CDNs, and no one has a full picture of where the app connects.
Action
For each extension, identify fetch and script-loading destinations and list them by HTTPS origin in allowed_sources .
Impact
Your app is covered by Shopify's app protection and malicious-request monitoring. The inventory itself also serves as documentation of your endpoints.
Tech note
If you can't fit within the 20-entry limit, consider consolidating behind an API gateway or CDN.
USE CASE 3

Build "update network_access" into your release process

Challenge
When new external APIs or domains are added, the TOML declaration is easily forgotten, bringing the warning back or dropping hosts from monitoring.
Action
Add "If you add an external host/origin, also update [network_access] " to your PR template or review checklist, and pair it withshopify app deploy .
Impact
Prevents missed declarations and keeps both UX and security consistently maintained.
Tech note
The article doesn't cover mechanisms like validating the TOML in CI. Rely on your team's review process to enforce it.

9One-line summary for proposals

"shopify.app.toml 's [network_access] — just list your external destinations and network hosts there, and
the external navigation warning goes away, and Shopify watches for suspicious traffic to your app.
If your app communicates externally, declare them now → deploy + release is recommended."