Shopify now requires an IP allowlist for every public app that calls the Admin API. If your tokens leak without one, anyone can use them from anywhere. We map your egress IPs or ASNs, configure the allowlist in your Dev Dashboard, and verify it against real traffic - in 48 to 72 hours, at a fixed price.
Source: official Shopify developer changelog, 5 Nov 2026
Admin API tokens for public apps are long-lived secrets. Without an IP allowlist, a token stolen from a log file, a repo, or a client-side bundle works from any server on the internet. The allowlist changes that: your tokens only work from the addresses or networks you list.
Most app teams have drift between what the code does and what the allowlist says: background jobs on one platform, webhooks on another, a queue worker in a third region. Configure the allowlist wrong and you break your own app hours before the biggest sales weeks of the year. That is the engineering problem we solve - on a deadline you do not control.
On serverless or dynamic IPs? A single static IP will not cut it. Shopify supports allowlisting by network (ASN) exactly for this case - that is the path we configure.
Inventory every IP and ASN your app actually sends Admin API traffic from - jobs, webhooks, queues, all regions - before anything is switched on.
Enter the mapped IPs/ASNs in your Partner Dev Dashboard, using ASN network allowlisting for serverless hosting.
Verify Admin API calls and bulk operations still succeed from every egress path, in staging and then production.
A short written record: what changed, what was tested, and how to add future infrastructure to the allowlist.
You keep control: we work in your Partner Dashboard with your permission, or hand your engineer the exact configuration to apply.
Fixed scope agreed in writing before we start. If we cannot get your allowlist passing, you do not pay.
Not sure which tier fits, or whether you are already compliant? Email us your hosting setup (static IP / serverless / multi-region) and your app's name in the Partner Dashboard. We reply with which tier applies and any blockers - no charge, no obligation.
Get the free readiness checkIs Sipiteno affiliated with Shopify?
No. We are an independent engineering consultancy. Everything here follows Shopify's public developer changelog, linked above.
What happens if we miss 12 November (bulk ops)?
Bulk queries and mutations from your public app are blocked until an allowlist is configured. Regular Admin API calls keep working until the later deadlines. Apps using bulk operations get priority in our queue.
We are on serverless with no stable IP. Is that a problem?
No. Shopify supports allowlisting by network with ASN support, built for serverless hosting. That is the Serverless or Rush tier.
Do you need access to merchant data or our stores?
No. This is Partner Dashboard configuration and your own infrastructure. We never touch merchant data.
How do payments work?
Fixed scope, fixed price, invoiced. We agree the scope in writing first; payment terms are on the invoice.