Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	23	644	November 8, 2026
Open-source search and filter bar for apps built with Polaris web components (admin parity) Polaris	0	2	November 9, 2026
Stylesheet subsetting doesn't seem to apply Online Store and Theme Development liquid , theme-troubleshootin , performance , theme-store	0	10	November 9, 2026
Different Expiring access tokens status App Security	15	267	November 9, 2026
Feature Request: Expose cart-level custom attributes (and the order note) to post-purchase, `transactioncomplete` and receipt targets Extensions pos-extensions	1	30	November 9, 2026
`insertBefore` in the customer account extension runtime leaves `nextSibling` stale, so Preact lists stop updating Extensions customer-account-ext	0	7	November 9, 2026
App stuck in repeated review failures for 4 months - how can we break the cycle? Shopify App Store app-store	0	15	November 9, 2026
Shopify Sidekick App Recommendations – A Nightmare for Developers Outside the Top 3? Shopify App Store app-store	63	1208	November 9, 2026
DMCA for a lookalike App Store icon closed in one minute as "not hosted by Shopify" Shopify App Store app-store	2	42	November 9, 2026
Metafield.translations can't replace TranslatableResourceType.METAFIELD for unpublished locales GraphQL Admin API Troubleshooting general-gql-troubles	0	8	November 9, 2026
Developer Dashboard > RE-Request Access > Not working Dev Platform dev-dashboard	9	94	November 9, 2026
Bulk operations access: why revoke it after 31 days if the app has an IP allowlist? App Security	0	22	November 9, 2026
Can an existing App Store app also sell subscriptions through its own web funnel? Shopify App Store app-store	14	309	November 9, 2026
Shopify-exit-interstitial - Popup Modal App Security education	27	1586	November 9, 2026
Would love more granular scopes/permissions for apps Authentication & Access access-scopes	5	70	November 9, 2026
Identify Sidekick installs in the shopify_app_install GA4 event Shopify App Store app-store	1	35	November 9, 2026
Product descriptions are untrusted, but Dawn and Horizon render them raw and Liquid can't sanitize them App Security horizon	2	53	November 9, 2026
"Action required: Review irregular API activity related to your Shopify app" email received for dev app App Security	2	35	November 9, 2026
Shopify Partnerships - not an app but leveraging the Shopify SDK Agentic Commerce	5	130	November 9, 2026
Liquid arrays & objects Online Store and Theme Development liquid	0	23	November 8, 2026
Market-driven shipping is now in feature preview — action may be required for your app Fulfillment & Inventory fulfillment-services	84	2263	November 8, 2026
Token Expiry FAQ Authentication & Access oauth	17	625	November 8, 2026
How Can I Sell Events as Shopify Products Without installing additional App? Online Store and Theme Development liquid , theme-editor , theme-troubleshootin	3	39	November 8, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	215	7017	November 8, 2026
Shopify Embedded App Redirect Loop After Deployment (/app → /auth/login → /) Shopify App Store app-store	2	47	November 8, 2026
Shopify App Submission Blocked by “Submission Limited” Error Shopify App Store app-store	4	82	November 8, 2026
S-table list layout drops the last column's label when there's no whitespace after the last s-table-header Polaris	0	12	November 8, 2026
How will Personal Agent Protocol sessions surface to apps? Shopify App Store partner-dash	1	54	November 8, 2026
<ui-save-bar> doesn't work in s-app-window App Bridge app-bridge	0	27	November 7, 2026
Question: Compatibility of Quantity-Based / Tiered Discounts with Shopify Native Subscriptions Functions discount-functions	4	42	November 7, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…