Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	23	729	November 8, 2026
Github Integration and Shopify CLI Issue - Templates and Sections are not uploaded if there are any schema errors Shopify CLI and Libraries theme-commands	6	301	November 11, 2026
storefrontAccessTokenCreate returns ACCESS_DENIED after converting an app into a sales channel (channel_config) GraphQL Admin API Troubleshooting general-gql-troubles	0	3	November 11, 2026
When can GDPR webhooks contain only a customer email without a customer ID? Webhooks and Events access-scopes , troubleshooting	0	3	November 11, 2026
Shopify App Pricing: The next generation of app billing Shopify App Store billing-api	55	4215	November 11, 2026
Shopify's new Changes Force us to retire after serving shopify for 9 years full-time Community Feedback	2	131	November 11, 2026
Registering Muse as a Shop Pay platform for UCP checkout (client_id, pay:wallet:read) Agentic Commerce	0	2	November 11, 2026
Updates to App Store submission requirements: build, grow, then expand Shopify App Store app-store	18	155	November 11, 2026
Raise the bulk query 5 connection limit due to variant barcodes Products and Orders APIs admin-api-variants	3	23	November 11, 2026
Bulk operations access: why revoke it after 31 days if the app has an IP allowlist? App Security	3	63	November 11, 2026
New App Uninstall Mandatory Reason Selection: Useless! Shopify App Store app-store	14	366	November 10, 2026
Manage payouts, billing, and settings in Dev Dashboard Dev Platform dev-dashboard	4	151	November 10, 2026
[iOS 11.2644.0] App Bridge Save Bar: embedded page stops receiving touches after Discard App Bridge app-bridge	1	21	November 10, 2026
[iOS / Android 11.x] Embedded app is not opened after install from Shopify Mobile since Oct 19 App Bridge app-bridge	1	22	November 10, 2026
Metaobject reference error Custom Data metaobjects	5	105	November 10, 2026
Draft Order line items not reflected in UI after changes Extensions admin-ui-extensions	24	821	November 10, 2026
App stuck in repeated review failures for 4 months - how can we break the cycle? Shopify App Store app-store	7	77	November 10, 2026
COD form rejected for bypassing checkout, is there a policy difference for existing apps? Shopify App Store app-store	3	33	November 10, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	217	7193	November 10, 2026
Customer Privacy API v0.2 Documentation Uncategorized	0	17	November 10, 2026
Shopify App Submission Blocked by “Submission Limited” Error Shopify App Store app-store	5	112	November 10, 2026
Shopify payments attributable part Shopify App Store app-store , app-pricing	2	37	November 10, 2026
App Review Delays Shopify App Store app-store	3	48	November 10, 2026
App owned metaobject bug Custom Data metaobjects	7	331	November 10, 2026
Nov 20 could be the App Store’s second delisting wave in two months. Anyone else bracing for it? Shopify App Store app-store	9	160	November 10, 2026
ASN allowlist still blocks Cloudflare IP address after inputting Cloudflare ASN Authentication & Access oauth	7	147	November 10, 2026
Suggestion for unlisted app exemption for new App Store submission rule Shopify App Store app-store	2	89	November 10, 2026
Is Shopify just no longer approving any more built for Shopify apps now? Built for Shopify	0	38	November 10, 2026
Sidekick with 20 apps per user Extensions sidekick-app-extensi	0	28	November 10, 2026
How does Shopify decide an app is non-compliant for the Jan 1, 2027 delisting? Banner still shows after migration Shopify App Store app-store	2	71	November 10, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…