Admin / Feature

See your connected apps' "access" and "security status"
all in one place in the admin

In Settings > Apps, you can check each app's latest activity, security issues that may need attention, permissions that may include sensitive data, and whether it supports required security measures (expiring tokens and IP restrictions).

On this page
  1. What's changing (in 30 seconds)
  2. Screen walkthrough: App list → Detail page
  3. The 2 required security measures you can check
  4. What you can check on each screen
  5. What the announcement doesn't cover
  6. How to check (3 steps)
  7. 5 key points for developers
  8. 3 business use cases
  9. One-line summary for proposals

1What's changing

In the Shopify admin, under Settings > Apps , you can now see more information than before about the apps connected to your store.
See in one place what this appcan access,,what it has been doing recently,,and whether it supports security measures.

Latest activity

The app list shows each app's most recent activity.

Security issue highlights

Security issues that may need attention are highlighted in the list.

Sensitive data permission labels

On the detail page, permissions that may include sensitive data are labeled.

2Screen walkthrough: App list → Detail page

App list (apps index) App Latest activity Status App A OK App B Needs review App C OK Latest activity + highlighted security issues Click App details page Consolidated into one section Access Permissions Potentially sensitive data Activity Access, permissions, activity + adoption of security measures
It's a two-step flow: use the list to see which apps need attention, then open the details page to check what each app can access, what permissions it has, and how it behaves.
* This diagram is a conceptual illustration based on the article. The actual screen layout differs.

32 required security measures you can check

On the app details page, you can check whether an app has adopted required security measures The article names the following 2.

Access token Expired Refreshed regularly Measure 1

Expiring access tokens

Credentials that expire and must be refreshed regularly.This shortens the window in which a stolen token can be misused.

Approved IPs Other IPs IP restrictions Shopify API Store data Measure 2

Enforced IP restrictions

Restricts requests to the Shopify API so thatonly approved IP addressescan be used by the app to access the store.

The article introduces these measures with "including," anddoesn't say whether these 2 are the only required security measures. It also doesn't say how apps that haven't adopted them are handled (e.g., suspended or only warned).

4What you can check on each screen

ScreenWhat you can checkHow it helps
App list Display Latest activity for each app See which apps have been active recently and which haven't
Apps list Highlights Security issues that may need attention Quickly find apps that need action
App details Consolidated Access, permissions, and activity in one section Check an app's scope of impact in one place
App details Labels Permissions that may include sensitive data Identify permissions that need attention
App details Adoption status Enforcement of expiring tokens / IP restrictions Check an app's security posture

5Not covered in the article

Not stated

Eligible plans and rollout

Eligible plans and rollout status across all stores are not stated.

Not stated

Retrieval via API / webhook

Whether the same information is available via API is not stated. Only the review feature in the admin is described.

Not stated

Required admin permissions

Which staff permissions are needed to view this page is not stated.

For details, see the Shopify Help Center page "Reviewing app access and security" linked from the article.

6How to review (3 steps)

1

Open Settings > Apps

In the Shopify admin, go from Settings to Apps.

2

Check highlights in the list

Review the latest activity and highlighted security issues.

3

Check the details page

Review access, permissions (sensitive data labels), activity, and security measure adoption status.

Since this is a review-only feature,no new setup is required(the article doesn't describe any steps to enable it). Starting with the highlights in the list is the quickest way in.

75 Key Points for Engineers

1. Expiring tokens become a visible evaluation criterion

Each app's support for token expiration is shown to merchants. App developers will be judged on whether their implementation handles refreshing tokens before they expire.

IP

2. IP restrictions require managing source IPs

Because API access is allowed only from approved IPs, it matters whether your app's servers use fixed, managed source IPs. Specific configuration steps aren't documented.

3. Sensitive data permissions get labeled

Permissions that may involve sensitive data are clearly flagged to merchants. This is a good prompt to check whether the permissions (scopes) your app requests are the minimum it needs.

API ?

4. API access isn't mentioned

The announcement covers only viewing this information in the admin. If you want to automate app audits, you'll need to check separately whether an API exposes the same information.

5. "Latest activity" makes unused apps easier to spot

Because the list shows latest activity, it's easier to spot apps that haven't run in a long time but still have access.A starting point for access audits (removing unneeded apps)—that's how you can put it to use.

83 Practical Use Cases

USE CASE 1

Make regular app audits part of operations

Challenge
As more apps get installed, it becomes hard to track which ones are still in use and what each one can access.
Action
Check Settings > Apps on a regular schedule, such as monthly, find apps with old latest activity, and consider removing them.
Impact
Fewer unneeded permissions left in place.
Tech note
It isn't documented whether the same information is available via API. For now, plan this as a manual process done in the admin.
USE CASE 2

Security checks before installing new apps

Challenge
When installing an app, there's little to go on when judging what sensitive data it can access or whether its security measures are adequate.
Action
After installing, use the app's details page to check permissions labeled as sensitive data and whether it uses expiring tokens and IP restrictions, then add these to your internal installation checklist.
Impact
Security information from Shopify can back up your app selection decisions.
Tech note
How apps without these measures are treated (a warning only, or restrictions) isn't documented. You'll need to set your own rules for these decisions.
App
USE CASE 3

Bring in-house and custom apps up to the required security measures

Challenge
Apps built in-house or by an agency may show up in the merchant's admin as not meeting security requirements.
Action
Update the app to use expiring tokens, and use a fixed source IP for API requests so the app can work with IP restrictions.
Impact
Merchants feel more confident, which cuts down on questions and concerns. If a token leaks, it stays usable for a shorter time.
Tech note
Specific implementation steps and configuration details are not covered in the article. Check the Shopify Help Center or developer documentation.

9One-line summary for proposals

"In Settings > Apps, you can now see each connected app'srecent activity, sensitive data permissions, and security compliance statusall in one place.
Start by reviewing the highlights in the list,and take stock of unused apps and apps that aren't compliantfirst."