Developer Changelog / App security

App IP allowlists now support ASNs
Serverless apps without static IPs can now use allowlists

In the Dev Dashboard IP allowlist, you can now allow "Networks (ASN)" in addition to IP addresses. You can add up to 10 ASNs and restrict access to up to 10 countries. IP allowlists will soon be required for all public apps.

On this page
  1. What changed (30-second overview)
  2. How it works: how requests are evaluated
  3. IP address allowlisting vs. Networks (ASN) allowlisting
  4. Configuration limits
  5. Setup steps (4 steps)
  6. What should your app do? (decision flow)
  7. 5 key points for developers
  8. 3 practical use cases
  9. One-line summary for proposals

1What changed

Until now, IP allowlists assumed you would register static IP addresses, which made them hard to use for apps on serverless infrastructure where the source IP changes.
Now,hosting providers' ASNs (Autonomous System Numbers)can be allowed, so even apps without static IPs can use an allowlist to restrict API access.
IP ?

Before: IP addresses only

Apps with static IPs could register them. Apps with dynamic source IPs had no fixed IPs to register.

ASN

Now: IP addresses or Networks (ASN)

In the IP allowlist on your app's Settings page, you can choose either "IP addresses" or "Networks (ASN)". With ASNs, you can also narrow access by country.

IP allowlists will soon be required for all public apps. Shopify strongly recommends that all apps use an IP allowlist. No specific date for the requirement has been given.

2How it works: how requests are evaluated

Your app Serverless infrastructure Source IP is dynamic Calls the Shopify API IP allowlist In an allowed ASN? In an allowed country? Yes Request allowed API responds as usual No Fails with 403 Requests from outside allowed networks * Requests are only rejected after enforcement is turned ON
ASN(Autonomous System Number): A number that identifies a group of networks managed by a single operator on the internet.
Because access is allowed based on which provider's network a request comes from rather than individual IP addresses, requests still get through even if the IP changes each time, as long as they come from the same hosting provider.

3IP address allowlisting vs. Networks (ASN) allowlisting

ItemIP addressesNetworks (ASN)
Best suited for Static IP Apps that call Shopify from static IPs Dynamic IP Apps whose source IP changes, such as serverless apps
What you register Source IP addresses Hosting provider ASNs + countries where the app runs
Limits Not specified Up to 10 ASNs / up to 10 countries
Requests from outside the allowlist 403 Fail with a 403 status once enforcement is ON
Where to configure Dev Dashboard > app Settings page > IP allowlist section

4Configuration limits

10
Maximum number of ASNs
10
Maximum number of countries you can restrict to
403
Status for requests outside the allowlist
Whether IP addresses and ASNs can be used together, the maximum number of IP addresses, and which APIs are covered are not specified. See the official documentation "Restrict API access with an IP allowlist" for details.

5Setup steps (4 steps)

1

Open the Dev Dashboard

Go to the IP allowlist section on your app's Settings page.

2
IP ASN

Select Networks (ASN)

Enter up to 10 ASNs and restrict to up to 10 countries.

3

Test against recent traffic

Check your configuration against actual recent traffic.

4

Turn enforcement ON

From then on, requests from outside allowed networks fail with a 403.

It's a two-stage process: test, then enforce,so you don't have to cut off production traffic all at once. Detailed steps are in the official documentation "Restrict API access with an IP allowlist".

6What should you do with your app? (decision flow)

What is your app's source IP? (egress IP) Static Dynamic Keep allowing your IP addresses If you call Shopify from static IPs, keep those addresses on the allowlist Allow your hosting provider's ASN + operating countries If your IPs change (e.g., serverless), register your provider's ASN and the countries your app runs in

75 key points for engineers

1. Soon required for public apps

IP allowlists are set to become required for all public apps. No deadline has been announced, so it's safest to set one up early rather than waiting for the requirement.

egress

2. First, check how your egress IPs behave

The method you choose depends on whether they're static or dynamic. Start by identifying which IPs in your infrastructure actually send traffic to Shopify.

10/10

3. Limits: 10 ASNs and 10 countries

If your app runs across multiple regions or providers, confirm in advance that it fits within the limits. When narrowing by country, list only the countries where your app actually runs.

403

4. Blocked requests return 403

Once enforcement is ON, calls from outside the allowlist get a 403. Make sure your app's error handling and monitoring can identify these 403s as an access configuration issue.

5. Test before enforcing

You can test your entries against recent traffic before turning enforcement ON.Make "don't enforce right away; check the test results for any missing traffic sources first"part of your operating procedure.

83 practical use cases

ASN
USE CASE 1

Get serverless public apps ready before the requirement takes effect

Challenge
A public app runs on serverless infrastructure, so its source IPs can't be fixed and no IP allowlist is set up. The requirement is approaching.
Approach
Choose Networks (ASN), register your hosting provider's ASN and the countries your app runs in → test against recent traffic → turn enforcement ON.
Impact
You can adopt the allowlist without extra infrastructure for static IPs, and avoid being caught out when it becomes required.
Technical notes
Up to 10 ASNs and 10 countries. Confirm the exact ASNs to register with your hosting provider (the article gives no specific examples).
USE CASE 2

Contain the damage of a leaked access token at the network boundary

Challenge
If your app's credentials leak, anyone could call the Shopify API from anywhere.
Approach
Set up an IP allowlist (IPs if static, ASN + countries if dynamic) and turn enforcement ON.
Impact
Requests from outside allowed networks fail with a 403, adding a network-level layer of defense on top of authentication. It also helps in security reviews and when explaining your setup to customers.
Technical notes
ASNs are allowed per provider, so they cover a broader range than specific IPs. Combine them with country restrictions.
Recent traffic
USE CASE 3

Staged rollout for dev teams managing multiple apps

Challenge
Several public apps (client-built and in-house) mean that enforcing allowlists everywhere at once risks one of them suddenly failing with 403 errors.
Approach
Inventory each app's egress IP characteristics → choose a method (IP or ASN) and register it → test for gaps → turn on enforcement one app at a time, starting with those that pass.
Impact
Complete the rollout for every app before it becomes mandatory, while minimizing the risk of production outages.
Tech notes
Set up alerts for 403 errors after enforcement, and make allowlist updates part of the change procedure for infrastructure changes (new regions, provider switches).

9One-line summary for proposals

"IP allowlists now support hosting provider ASNs (up to 10 ASNs, up to 10 countries),
so even serverless apps without fixed IPs can restrict API access.
This will soon be required for public apps, so set it up now: test first, then enforce."