Shopify platform deadline
Shopify IP allowlist cheat-sheet for public apps
Every public Shopify app must declare an IP allowlist by 20 November 2026, 11:59 PM ET. Apps that do not are removed from the App Store and blocked from new installs. Here is the paste-ready ASN for each host Shopify app developers actually ship on — with a link to the provider's own docs so you can verify before you paste.
ASNs by hosting provider
Pick the row that matches the host your Shopify-calling code runs on — not your marketing site's host. Shopify caps the allowlist at ten ASNs and ten countries, so prefer a CIDR (reserved egress IP) when your provider exposes one.
Vercel
Vercel Functions / Edge
AS16509AWS (serverless + edge egress)Vercel runs serverless functions on AWS and does not publish a stable CIDR range — allowlist AS16509 and rely on Shopify's country filter to narrow.
AWS Lambda
Lambda / API Gateway
AS16509Amazon (global egress)AS14618Amazon AES (us-east-1 fallback)Lambda egresses from AWS-owned ASNs. If you deploy to a fixed region, pair this with a country filter (us-east-1 → US, eu-west-1 → IE) so the allowlist stays narrow.
Cloudflare Workers
Workers / Pages Functions
AS13335CloudflareWorkers egress from Cloudflare's own ASN — one entry is enough. Cloudflare's country footprint is wider than Shopify's 10-country cap, so pick the regions your merchants live in.
Fly.io
Machines / Fly Edge
AS14061Fly.io (via DigitalOcean upstream)Fly runs on DigitalOcean's ASN today. Expect this to shift if Fly re-homes a region; re-check if your calls start failing without a code change.
Render
Web Services / Background Workers
AS14618Amazon AES (Render's AWS region)Render's web services run on AWS. The exact ASN tracks your Render region — Oregon maps to AS16509, Ohio to AS14618; check Render's networking page for yours.
Heroku
Heroku Dynos
AS16509Amazon (Heroku's underlying ASN)Standard dynos egress from AWS; Private Spaces offer fixed CIDRs instead — if you're on a Space, allowlist those instead of the ASN.
Railway
Services / Workers
AS396982Google Cloud (Railway's current upstream)Railway deploys services into GCP. Railway Pro offers a static egress IP — if you have one, allowlist it as a CIDR and skip the ASN.
DigitalOcean App Platform
App Platform Components
AS14061DigitalOceanApp Platform components share DigitalOcean's egress ASN. Droplets with reserved IPs can be allowlisted as a CIDR instead.
GCP Cloud Run
Cloud Run / Cloud Functions
AS15169Google (us-central1, global default)AS396982Google Cloud (newer regions)Cloud Run egresses from Google's ASNs. For a fixed IP, attach a Serverless VPC Access connector to a NAT with a reserved address and allowlist that CIDR instead.
Three mistakes we've seen on community.shopify.dev
- 1
Allowlisting the CDN instead of the function
Your website runs on Cloudflare, but your app's API call to Shopify does not come from Cloudflare — it comes from the server behind it. Allowlist the host that signs the Admin API request, not the CDN that serves your marketing page.
- 2
Forgetting the country filter
Shopify asks for ten countries in addition to ten ASNs. An AWS ASN plus no country filter is wider than you want. Pick only the regions your functions actually deploy to.
- 3
Pasting a provider's 'all IPs' JSON into one field
Shopify's partner dashboard expects individual entries, not a blob. If your provider exposes a JSON list of ranges, pick the regions you use and paste them one at a time.
Test before you enforce
Shopify's partner dashboard separates declaring an allowlist from enforcing it. Use that gap.
- 1. Declare, don't enforce. Paste the ASNs for every host your code runs on, then save with enforcement switched OFF.
- 2. Trigger every API path. Install your app on a dev store and exercise each flow — install, uninstall, webhook, scheduled job, support-dashboard admin call. If you have a staging environment on a different host, do it from there too.
- 3. Read the audit log. The partner dashboard logs every call as would allow or would block while enforcement is off. A clean log is the only green light.
- 4. Flip enforcement on. Any gap you missed now shows up as a real 403 — not a delisting.
FAQ
Who does this apply to?
Every public Shopify app listed in the App Store. Custom apps and merchant-created apps are unaffected. Apps that use bulk operations had an earlier cut-off (12 November 2026).
What happens on 20 November if I do nothing?
Shopify removes the app from the App Store and blocks new installations. Existing installs stay active but can no longer make Admin API calls from un-allowlisted IPs, which breaks nearly every app worth running.
I run on Vercel / Lambda / Fly — what's the right ASN?
Use the table above. Each row names the ASN your host egresses from and links to the provider's own networking documentation so you can verify before you paste.
Shopify's dashboard only lets me paste ten ASNs and ten countries — is that enough?
For a single-provider deployment, yes. If you call Shopify from more than one host (a worker on Cloudflare, a long-running job on Render, a scheduled Lambda) you have to pick the ten that matter most. Allowlist your production path first; cron-only paths can be redeployed onto the same provider later.
Can I allowlist a CIDR range instead?
Yes, if your provider gives you a static egress IP (Heroku Private Spaces, Render static outbound IP, Railway Pro, a GCP NAT with a reserved address). A CIDR is strictly narrower than an ASN, so prefer it when you have one.
How do I test it without being locked out?
Shopify's partner dashboard lets you add ASNs without enforcing them first. Add your entries, leave enforcement off, call your own app from each environment that reaches Shopify, and watch the audit log for any call that would have been blocked. Flip enforcement on only when the log is clean.
Know another Shopify app developer?
This page is free, there is no signup, and nobody is buying ad space on it. Send it to the Slack channel where your partners compare notes — Shopify is delisting apps on 20 November, and a friend who misses the memo loses their listing.