Shopify Developer Community Forums

Topic	Replies	Views	Activity
App security updates: IP allowlist is now required App Security On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…	21	379	November 6, 2026
3 years running my app, and getting merchants to leave a review is still the hardest part Shopify App Store app-store	8	109	November 6, 2026
Nov 20 could be the App Store’s second delisting wave in two months. Anyone else bracing for it? Shopify App Store app-store	3	54	November 6, 2026
Shopify payments attributable part Shopify App Store app-store , app-pricing	0	6	November 6, 2026
Special characters in app titles and subtitles Shopify App Store app-store	0	7	November 6, 2026
Question: Compatibility of Quantity-Based / Tiered Discounts with Shopify Native Subscriptions Functions discount-functions	0	10	November 6, 2026
Polaris web components are a DX nightmare for non-react devs Polaris	2	226	November 6, 2026
Migrating from non expiring to expiring access tokens Authentication & Access oauth	205	6558	November 6, 2026
Would love more granular scopes/permissions for apps Authentication & Access access-scopes	3	30	November 6, 2026
Red Alert Issue flagged by BFS Reviewer Functions general-functions	3	80	November 6, 2026
Action required: migrate to expiring offline access tokens before January 1, 2027 Authentication & Access oauth	34	640	November 6, 2026
Polaris 2.0 RC is great, but we still can't match the admin's index table Polaris web-components	11	449	November 6, 2026
Cloudflare ASN and Hetzner Server IP how to have both Dev Platform dev-stores , app-deployment	0	25	November 6, 2026
New Folder Option in File / Possible API-Access? Uncategorized	2	43	November 6, 2026
Different Expiring access tokens status App Security	3	77	November 6, 2026
Manage payouts, billing, and settings in Dev Dashboard Dev Platform dev-dashboard	2	121	November 6, 2026
How can a Token-tier UCP client obtain permission to call complete_checkout? Agentic Commerce	13	473	November 6, 2026
Identify B2B Orders with Payment Terms on Vaulted Credit Cards GraphQL Admin API Troubleshooting general-gql-troubles	3	34	November 5, 2026
Admin dark mode: the dark Polaris token set already ships - here's what's left, with accessibility data Polaris	0	46	November 5, 2026
[Feature request] Allow customAttributes input (line item properties) for orderEdit API Products and Orders APIs admin-api-orders	29	1475	November 5, 2026
Embedded app checks pending 29+ hours, Submit for review disabled (App ID 443196637185) - requesting manual verification Shopify App Store partner-dash	1	45	November 5, 2026
Feature request: Choose specific keys from Translations Products and Orders APIs admin-api-products	1	34	November 5, 2026
FenestryBot: Web Bot Auth signature verifies, registration submitted 2 Nov 2026, how do we get the key activated? Online Store and Theme Development performance	2	28	November 5, 2026
Follow-up on our crawler registration: ProductGale (Web Bot Auth) Online Store and Theme Development performance	1	28	November 5, 2026
Need Help fixing code in liquid block Online Store and Theme Development liquid	1	35	November 5, 2026
How can public apps collect required custom fields (e.g. delivery date) in UCP / agentic checkout? Agentic Commerce extensions	1	50	November 5, 2026
ASN allowlist still blocks Cloudflare IP address after inputting Cloudflare ASN Authentication & Access oauth	5	74	November 5, 2026
App Bridge: one unparseable <a href> anywhere in the app document silently breaks admin sidebar navigation App Bridge app-bridge	2	58	November 5, 2026
New Tier system - do collaborator stores have no value now? Community Feedback	0	34	November 5, 2026
Partner Town Hall about security...Really? Uncategorized	7	110	November 5, 2026

App security updates: IP allowlist is now required

On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can’t be used anywhere but your own servers. Wit…