Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	23	700	November 8, 2026
Raise the bulk query 5 connection limit due to variant barcodes Products and Orders APIs admin-api-variants	0	5	November 10, 2026
Draft Order line items not reflected in UI after changes Extensions admin-ui-extensions	23	811	November 10, 2026
App pricing - what happens to delete pricing plan? Shopify App Store app-pricing	0	8	November 10, 2026
App usage based pricing - remove a usage event Shopify App Store app-pricing	0	6	November 10, 2026
Shopify Sidekick App Recommendations – A Nightmare for Developers Outside the Top 3? Shopify App Store app-store	69	1374	November 10, 2026
[BUG] Icon-only s-button in s-section secondary-actions shifts and flickers on hover Polaris	3	69	November 10, 2026
Block email changes for customers Extensions customer-account-ext	5	193	November 10, 2026
Different Expiring access tokens status App Security	18	327	November 10, 2026
Action required: migrate to expiring offline access tokens before January 1, 2027 Authentication & Access oauth	35	773	November 10, 2026
POS UI extension: record a payment from a third-party cash recycler? Local network access from iPad? Extensions pos-extensions	2	21	November 10, 2026
Bulk operations access: why revoke it after 31 days if the app has an IP allowlist? App Security	2	51	November 10, 2026
App stuck in repeated review failures for 4 months - how can we break the cycle? Shopify App Store app-store	4	51	November 10, 2026
Before BFCM: new Shopify app reviews fell 13% in 30 days, and most arrive on day one or after 2+ months Shopify App Store app-store	0	20	November 10, 2026
App Review Delays Shopify App Store app-store	1	20	November 10, 2026
Deprecated_api_calls.json returns "Not found" with new Dev Dashboard token (works with legacy app token) Dev Platform dev-dashboard	6	202	November 10, 2026
App owned Metaobject definitions in the TOML seem flakey Custom Data metaobjects	19	291	November 10, 2026
Securing your app, together App Security	23	3677	November 10, 2026
[iOS / Android 11.x] Embedded app is not opened after install from Shopify Mobile since Oct 19 App Bridge app-bridge	0	16	November 10, 2026
Market context overrides of theme settings ignore the preset when `current` is a preset name Markets	4	77	November 10, 2026
POS UI extensions: separate labels for the Add tile picker and the cart line "Additional details" action Extensions pos-extensions	0	11	November 10, 2026
Can an existing App Store app also sell subscriptions through its own web funnel? Shopify App Store app-store	17	348	November 10, 2026
How Can I Safely Test Changes to a Live Shopify Theme Without Affecting Customers? Online Store and Theme Development	2	34	November 10, 2026
Token Expiry FAQ Authentication & Access oauth	19	703	November 10, 2026
Third-party Web Bot Auth: TSSCatalogue registration submitted, HTTP 429 persists Online Store and Theme Development performance	0	15	November 10, 2026
[iOS 11.2644.0] App Bridge Save Bar: embedded page stops receiving touches after Discard App Bridge app-bridge	0	16	November 10, 2026
Can a deal aggregator register for Web Bot Auth under the API terms? Online Store and Theme Development ajax-api	2	62	November 10, 2026
fontSize on s-heading / s-text is stripped in App Home UI extension Shopify App Store app-store	0	11	November 10, 2026
How much content should be added to a theme demo store? Theme Store	0	18	November 10, 2026
COD form rejected for bypassing checkout, is there a policy difference for existing apps? Shopify App Store app-store	0	14	November 10, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…