Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	28	961	November 13, 2026
Update: Token expiry opt-in Authentication & Access oauth	2	31	November 13, 2026
App Proxy intermittently fails ("There was an error in the third-party application") and requests are never forwarded to the origin App Security	3	37	November 13, 2026
`insertBefore` in the customer account extension runtime leaves `nextSibling` stale, so Preact lists stop updating Extensions customer-account-ext	3	34	November 13, 2026
Any way to force users from /checkout to /cart? Functions general-functions	3	28	November 13, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	228	7480	November 13, 2026
A rollouts request Uncategorized	2	35	November 13, 2026
Detecting a closed or paused store from an installed app: is shop/update + plan_name the intended path? Shopify App Store app-store	1	35	November 13, 2026
[BUG] iOS Shopify mobile app crashes when printing Extensions admin-ui-extensions	1	13	November 13, 2026
Review processes for Admin - Export data & Theme zip download behaviour Uncategorized	1	26	November 13, 2026
How will Personal Agent Protocol sessions surface to apps? Agentic Commerce	2	65	November 13, 2026
Optics in Agentic Commerce Agentic Commerce	1	29	November 13, 2026
Network access list limit too less Dev Platform app-deployment	3	84	November 13, 2026
Customer metafield definitions segment filter limit Custom Data metafields	4	43	November 13, 2026
Shopify Embedded App Redirect Loop After Deployment (/app → /auth/login → /) App Bridge app-bridge	3	59	November 13, 2026
Inconsistency on metafield fields returned by queries GraphQL Admin API Troubleshooting general-gql-troubles	2	46	November 13, 2026
Meet Canvas: a new way for merchants to design their online store with Sidekick. Extensions theme-app-extension	45	1397	November 13, 2026
Default market not respected by shopify theme dev Online Store and Theme Development theme-troubleshootin	2	21	November 13, 2026
Cart Transform cost.compareAtAmountPerQuantity ignores catalog pricing when EEA “hide compare‑at” is enabled Functions cart-transform	5	113	November 13, 2026
App Review rejections Shopify App Store app-store	1	51	November 13, 2026
Shopify Extension Deployment Error: Total size of locale data exceeds 256 KB limit Extensions checkout-ui-ext , customer-account-ext	4	247	November 13, 2026
Feature Request: Allow configuring both Networks (ASN) and IP Addresses in App Allowlist simultaneously App Security new-gql-apis	2	41	November 13, 2026
No UCP successor for search_shop_policies_and_faqs before the Aug 31 sunset Agentic Commerce	2	99	November 13, 2026
Public App Not Using Admin API — Is Stopping Offline Token Acquisition Sufficient for 2027 Compliance? Authentication & Access oauth	1	20	November 13, 2026
How Can I Safely Test Changes to a Live Shopify Theme Without Affecting Customers? Online Store and Theme Development	4	52	November 13, 2026
Shop Pay Path B OAuth — access_denied on Catalog client (pay:wallet:read) and invalid_request on App client (identity link) Agentic Commerce	4	53	November 13, 2026
Shopify API Compliance – Address Fill Shopify App Store app-store	3	76	November 13, 2026
Updates to App Store submission requirements: build, grow, then expand Shopify App Store app-store	27	457	November 13, 2026
translationsRegister on ONLINE_STORE_THEME_LOCALE_CONTENT: a second write before the first is served loses the first one GraphQL Admin API Troubleshooting general-gql-troubles	2	40	November 13, 2026
[FEATURE REQUEST] Web Crypto unavailable in POS UI Extensions (iOS & Android) and admin UI extensions Extensions pos-extensions	2	98	November 13, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…