Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	22	535	November 7, 2026
Token Expiry FAQ Authentication & Access oauth	16	563	November 8, 2026
Shopify App Submission Blocked by “Submission Limited” Error Shopify App Store app-store	4	56	November 8, 2026
Different Expiring access tokens status App Security	9	218	November 8, 2026
How Can I Sell Events as Shopify Products Without installing additional App? Online Store and Theme Development liquid , theme-editor , theme-troubleshootin	0	10	November 8, 2026
S-table list layout drops the last column's label when there's no whitespace after the last s-table-header Polaris	0	7	November 8, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	214	6893	November 8, 2026
How will Personal Agent Protocol sessions surface to apps? Shopify App Store partner-dash	1	51	November 8, 2026
Feature Request: Expose cart-level custom attributes (and the order note) to post-purchase, `transactioncomplete` and receipt targets Extensions pos-extensions	0	14	November 8, 2026
Shopify Embedded App Redirect Loop After Deployment (/app → /auth/login → /) Shopify App Store app-store	1	27	November 8, 2026
<ui-save-bar> doesn't work in s-app-window App Bridge app-bridge	0	18	November 7, 2026
Question: Compatibility of Quantity-Based / Tiered Discounts with Shopify Native Subscriptions Functions discount-functions	4	38	November 7, 2026
[Feature Request] Add a note (or description) field to Store Credit Account transactions GraphQL Admin API Troubleshooting general-gql-troubles	7	188	November 7, 2026
Events: no Product trigger for seo.title / seo.description Webhooks and Events configuring	0	15	November 7, 2026
Admin dark mode: the dark Polaris token set already ships - here's what's left, with accessibility data Polaris	2	77	November 7, 2026
CARAXES-ShopFinder (Web Bot Auth): registration submitted 7 Nov 2026, signed requests still return 429 Online Store and Theme Development performance	0	16	November 7, 2026
Shopify's new Changes Force us to retire after serving shopify for 9 years full-time Community Feedback	1	90	November 7, 2026
Special characters in app titles and subtitles Shopify App Store app-store	4	55	November 7, 2026
Shopify payments attributable part Shopify App Store app-store , app-pricing	1	32	November 7, 2026
Shopify Address Fill App – Plus and Non-Plus Checkout Compatibility Shopify App Store app-store	4	65	November 7, 2026
Are we allowed to create fulfillment services to manage inventory and location for locations owned and operated by the merchant? Fulfillment & Inventory fulfillment-services , inventory-management	4	86	November 7, 2026
ASN allowlist still blocks Cloudflare IP address after inputting Cloudflare ASN Authentication & Access oauth	6	115	November 6, 2026
Identify B2B Orders with Payment Terms on Vaulted Credit Cards GraphQL Admin API Troubleshooting general-gql-troubles	4	45	November 6, 2026
Suggestion for unlisted app exemption for new App Store submission rule Shopify App Store app-store	1	54	November 6, 2026
New Tier system - do collaborator stores have no value now? Community Feedback	5	91	November 6, 2026
Incorrect region name with Market-driven shipping Markets	5	65	November 6, 2026
Shopify app billing subscription flow(Manual Pricing) Shopify App Store app-pricing	5	73	November 6, 2026
`theme dev` can't render market subfolder URLs on stores with a custom primary domain Markets	2	31	November 6, 2026
"Unknown" status for Enforced IP restrictions in store settings > Apps App Security	3	49	November 6, 2026
Feature Request: send a "Contact customer" notification via API Products and Orders APIs admin-api-orders	5	65	November 6, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…