--- title: Restrict Admin API access with an IP allowlist | daily.dev description: Shopify apps can now restrict Admin API access tokens to specific IP addresses. A new 'IP allowlist' section on the app's Settings page lets developers enter... canonical: https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Restrict Admin API access with an IP allowlist | daily.dev og:description: Shopify apps can now restrict Admin API access tokens to specific IP addresses. A new 'IP allowlist' section on the app's Settings page lets developers enter... og:url: https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr og:image: https://api.daily.dev/og/posts/SzmvRDuDR.png og:image:alt: Restrict Admin API access with an IP allowlist og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Restrict Admin API access with an IP allowlist **[Shopify Developer changelog](https://daily.dev/sources/shopifychangelog)** · 1 min read · 0 upvotes · 0 comments ## Summary Shopify apps can now restrict Admin API access tokens to specific IP addresses. A new 'IP allowlist' section on the app's Settings page lets developers enter server IPs or CIDR ranges, test them against recent traffic, and enable enforcement. Once enforced, requests to the GraphQL or REST Admin API from outside the allowed ranges fail with a 403 status code. Shopify recommends this for apps calling from static IPs; support for serverless apps with dynamic IPs is coming soon. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I restrict Shopify Admin API access to specific IP addresses? Add your servers' IP addresses or CIDR ranges to the new IP allowlist section on your app's Settings page in the Dev Dashboard, test them against recent traffic, then enable enforcement. Once enabled, GraphQL Admin API and REST Admin API requests using your app's tokens from outside those ranges are rejected with a 403 status code. _daily.dev helps developers securing Shopify integrations keep up with API access control changes like this._ ### Does Shopify's Admin API IP allowlist work for apps hosted on serverless platforms? Not yet. Shopify's IP allowlist feature currently requires static IP addresses for your servers, and support for apps hosted on serverless platforms with dynamic IP addresses is coming soon. _Teams weighing serverless hosting against this constraint can track the rollout on daily.dev._ ## Similar posts on daily.dev - [Securing your app, together](https://daily.dev/posts/securing-your-app-together-6ob3d6j33) · Shopify Developer changelog · 1 upvotes · 0 comments - [Shopify Lets You Script the Token, Not the App](https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt) · API Evangelist · 0 upvotes · 0 comments - [A new allowlists design for Grafana Cloud IP addresses: What you need to know](https://daily.dev/posts/a-new-allowlists-design-for-grafana-cloud-ip-addresses-what-you-need-to-know-bucsljwkb) · Grafana Labs · 1 upvotes · 0 comments - [Apollo API IP Allowlist Update: Second IP Addresss Now Live](https://daily.dev/posts/apollo-api-ip-allowlist-update-second-ip-addresss-now-live-i9smur51k) · Apollo Blog · 0 upvotes · 0 comments - [Secure your app with network access rules in shopify.app.toml](https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba) · Shopify Developer changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Restrict Admin API access with an IP allowlist","url":"https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr"},"datePublished":"2026-10-27T16:05:47.209Z","dateModified":"2026-10-27T16:12:52.361Z","description":"Shopify apps can now restrict Admin API access tokens to specific IP addresses. A new 'IP allowlist' section on the app's Settings page lets developers enter...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Shopify Developer changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Shopify Developer changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aefcb5d2c1ca4b45b5d2256b9e2a9cc3","url":"https://daily.dev/sources/shopifychangelog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,shopify","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Shopify Developer changelog","item":"https://daily.dev/sources/shopifychangelog"},{"@type":"ListItem","position":3,"name":"Restrict Admin API access with an IP allowlist"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr#faq","mainEntity":[{"@type":"Question","name":"How do I restrict Shopify Admin API access to specific IP addresses?","acceptedAnswer":{"@type":"Answer","text":"Add your servers' IP addresses or CIDR ranges to the new IP allowlist section on your app's Settings page in the Dev Dashboard, test them against recent traffic, then enable enforcement. Once enabled, GraphQL Admin API and REST Admin API requests using your app's tokens from outside those ranges are rejected with a 403 status code. daily.dev helps developers securing Shopify integrations keep up with API access control changes like this."}},{"@type":"Question","name":"Does Shopify's Admin API IP allowlist work for apps hosted on serverless platforms?","acceptedAnswer":{"@type":"Answer","text":"Not yet. Shopify's IP allowlist feature currently requires static IP addresses for your servers, and support for apps hosted on serverless platforms with dynamic IP addresses is coming soon. Teams weighing serverless hosting against this constraint can track the rollout on daily.dev."}}]} ```