--- title: Secure your app with network access rules in... description: Shopify apps can now declare external hosts and servers in a new [network_access] section of shopify.app.toml. The allowed_navigation_hosts property lists... canonical: https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Secure your app with network access rules in shopify.app.toml | daily.dev og:description: Shopify apps can now declare external hosts and servers in a new [network_access] section of shopify.app.toml. The allowed_navigation_hosts property lists... og:url: https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba og:image: https://api.daily.dev/og/posts/AVlkTrcba.png og:image:alt: Secure your app with network access rules in shopify.app.toml og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Secure your app with network access rules in shopify.app.toml **[Shopify Developer changelog](https://daily.dev/sources/shopifychangelog)** · 2 min read · 0 upvotes · 0 comments ## Summary Shopify apps can now declare external hosts and servers in a new [network_access] section of shopify.app.toml. The allowed_navigation_hosts property lists sites your app links customers to, skipping Shopify's outside-URL warning for those links. The allowed_sources property lists up to 20 HTTPS origins your app's code loads from or sends requests to on storefront, checkout, and admin pages, which Shopify uses to spot suspicious activity. Each property supports up to 20 entries. After adding your hosts, run 'shopify app deploy' and release the new version. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I declare allowed external hosts in shopify.app.toml? Add a [network_access] section with allowed_navigation_hosts and allowed_sources arrays. allowed_navigation_hosts lists external sites your app links customers to from the storefront, skipping Shopify's outside-URL warning; allowed_sources lists up to 20 HTTPS origins your app's code loads from or sends requests to on storefront, checkout, and admin pages. Example: allowed_navigation_hosts = ["app.example.com"], allowed_sources = ["https://api.app.example.com"]. _Shipping a Shopify app update? Track config changes like network_access on daily.dev._ ### What is the maximum number of hosts allowed in shopify.app.toml network_access settings? Both allowed_navigation_hosts and allowed_sources support up to 20 entries each. allowed_navigation_hosts lists navigation targets like your app's own domain, while allowed_sources lists up to 20 HTTPS origins your app's code loads from or sends requests to across storefront, checkout, and admin pages. _Developers tightening Shopify app security configs can follow updates like this on daily.dev._ ### How do I deploy changes after editing shopify.app.toml network_access settings? After adding your hosts and servers to the [network_access] section of shopify.app.toml, run 'shopify app deploy' and release the new version to apply the changes. _Keep up with Shopify CLI workflow changes like deploy steps on daily.dev._ ## Similar posts on daily.dev - [Securing your app, together](https://daily.dev/posts/securing-your-app-together-6ob3d6j33) · Shopify Developer changelog · 1 upvotes · 0 comments - [Restrict Admin API access with an IP allowlist](https://daily.dev/posts/restrict-admin-api-access-with-an-ip-allowlist-szmvrdudr) · Shopify Developer changelog · 0 upvotes · 0 comments - [The Shopify Goldmine: How to Build Your First App in Rails](https://daily.dev/posts/the-shopify-goldmine-how-to-build-your-first-app-in-rails-bv2aoxyoa) · Ruby Flow · 0 upvotes · 0 comments - [Appoval: Ship to the App Store with confidence](https://daily.dev/posts/appoval-ship-to-the-app-store-with-confidence-sm9ro8nna) · Product Hunt · 4 upvotes · 0 comments - [Build with confidence: Shopify AI Toolkit's security check](https://daily.dev/posts/build-with-confidence-shopify-ai-toolkit-s-security-check-ml3c5wu1a) · Shopify Developer changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#appsec](https://daily.dev/tags/appsec), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Secure your app with network access rules in shopify.app.toml","url":"https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba"},"datePublished":"2026-10-27T16:05:47.251Z","dateModified":"2026-10-27T16:10:52.750Z","description":"Shopify apps can now declare external hosts and servers in a new [network_access] section of shopify.app.toml. The allowed_navigation_hosts property lists...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a5b9f0de82c011d79696b4f6b99b7364?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Shopify Developer changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Shopify Developer changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aefcb5d2c1ca4b45b5d2256b9e2a9cc3","url":"https://daily.dev/sources/shopifychangelog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,appsec,shopify","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Shopify Developer changelog","item":"https://daily.dev/sources/shopifychangelog"},{"@type":"ListItem","position":3,"name":"Secure your app with network access rules in shopify.app.toml"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/secure-your-app-with-network-access-rules-in-shopify-app-toml-avlktrcba#faq","mainEntity":[{"@type":"Question","name":"How do I declare allowed external hosts in shopify.app.toml?","acceptedAnswer":{"@type":"Answer","text":"Add a [network_access] section with allowed_navigation_hosts and allowed_sources arrays. allowed_navigation_hosts lists external sites your app links customers to from the storefront, skipping Shopify's outside-URL warning; allowed_sources lists up to 20 HTTPS origins your app's code loads from or sends requests to on storefront, checkout, and admin pages. Example: allowed_navigation_hosts = [\"app.example.com\"], allowed_sources = [\"https://api.app.example.com\"]. Shipping a Shopify app update? Track config changes like network_access on daily.dev."}},{"@type":"Question","name":"What is the maximum number of hosts allowed in shopify.app.toml network_access settings?","acceptedAnswer":{"@type":"Answer","text":"Both allowed_navigation_hosts and allowed_sources support up to 20 entries each. allowed_navigation_hosts lists navigation targets like your app's own domain, while allowed_sources lists up to 20 HTTPS origins your app's code loads from or sends requests to across storefront, checkout, and admin pages. Developers tightening Shopify app security configs can follow updates like this on daily.dev."}},{"@type":"Question","name":"How do I deploy changes after editing shopify.app.toml network_access settings?","acceptedAnswer":{"@type":"Answer","text":"After adding your hosts and servers to the [network_access] section of shopify.app.toml, run 'shopify app deploy' and release the new version to apply the changes. Keep up with Shopify CLI workflow changes like deploy steps on daily.dev."}}]} ```