Shopify Changelog Recap
Shopify Changelog Recap: Public App IP Allowlists, App Security in Your Admin, and Extension Health
This recap covers Shopify changes posted from November 2 to November 8, 2026. The main changes are all about the apps connected to your store. The first one sets deadlines of November 12 and November 20, 2026. Each section links to Shopify's own pages so you can check the details yourself.
Published November 9, 2026. Author: Ecomm Guys. 5 min read.
1. Public Apps Need an IP Allowlist by November 20
What changed. Shopify now requires every public app to set up an IP allowlist, which limits the networks its Admin API tokens can be used from. Shopify says this reduces the damage if an app's credentials ever leak. For public apps that use bulk operations, the deadline was November 12, 2026 at 11:59 PM ET. Since then, bulk operations from public apps without an allowlist fail to run.
Every other public app has a deadline of November 20, 2026 at 11:59 PM ET. From then, public apps without an allowlist are delisted from the Shopify App Store, blocked from new installs, and flagged in Settings > Apps.
Shopify's timeline continues after that. From January 15, 2027, merchants see a warning in their admin for apps without an allowlist, and from April 1, 2027, those apps' Admin API requests fail. Existing installs keep working until April 1, 2027.
Who it affects. Any store that uses apps from the Shopify App Store. This rule covers public apps, and apps you created yourself in the admin or the Dev Dashboard fall outside it. Custom apps installed on stores outside the organization that owns them have their own dates, which Shopify announced on November 11, 2026.
What to do. Open Settings > Apps and check the security details for the apps you depend on most, especially anything that syncs products, inventory, or prices in bulk. If an app's developer hasn't set up the allowlist, ask them about their plan, because bulk syncs were the first thing to stop, on November 12.
Sources: Shopify Developer Changelog: Public apps, Nov 5, 2026, App security updates, Nov 5, 2026, and Shopify Developer Changelog: Custom apps, Nov 11, 2026
2. Settings > Apps Shows What Each App Can Access
What changed. Settings > Apps now shows more about the apps connected to your store. The apps list shows each app's latest activity and highlights security issues that may need your attention. On an app's details page, access, permissions, and activity sit together in one section, with labels on permissions that may include sensitive data.
Each app's details page also shows whether the app has adopted two security measures. Expiring access tokens are credentials that must be renewed regularly, which shortens how long a stolen token could be used. Enforced IP restrictions limit the app's Shopify API requests to approved IP addresses. The Help Center says each check shows as Configured, Missing, or Unknown. The checks describe how an app is set up, and the Help Center says they aren't an overall security rating.
Who it affects. Every store with third-party apps installed. The Help Center says staff need the Manage and install apps and channels permission to see an app's security checks.
What to do. Go to Settings > Apps, click each app you rely on, and look at the Security section. If a check shows Missing, the Help Center suggests asking the developer when they plan to set it up. You can also keep the app and check again later, or uninstall it if you no longer use it. We'd also look for apps that can reach customer or financial data and ask whether each one still needs that access.
Sources: Shopify Changelog, Nov 5, 2026 and Shopify Help Center: Managing apps
3. Extension Health Will Show in Settings > Apps
What changed. App developers can now see in the Dev Dashboard how often their checkout and customer account UI extensions fail to load, and on which stores. When an extension fails to load, buyers don't see what the app adds to checkout or customer accounts. Only failures caused by the app are counted.
Shopify's November 6 post says merchants will see the same health information in Settings > Apps for the extensions installed on their store, without giving a date. Each extension's current version gets a status based on its last 7 days of loads. Warning means Shopify is confident that more than 5% of loads have been failing for 3 days. Critical means more than 50% have been failing for 2 days, and staff who can view reports and access the app get an alert in the admin.
Who it affects. Stores that use apps with checkout or customer account extensions. Extensions with fewer than 10 loads in a week aren't rated.
What to do. There's nothing to set up. Once the statuses appear in Settings > Apps, treat a Critical alert as urgent and contact the app's developer, because some buyers aren't seeing that part of your checkout or customer account.
Sources: Shopify Developer Changelog, Nov 6, 2026
Also Worth Knowing
Apps built by Shopify partners now need access to bulk operations before they can run bulk queries or bulk mutations. Apps that already ran them were given access automatically. An app that hasn't run one in the last 31 days loses access until its developer turns it back on. Source, Nov 6, 2026
Starting with API version 2027-01, apps that manage store credit can attach a note to each credit or debit that only merchants see. Source, Nov 6, 2026
You can book a call with us if you'd like help working through any of these on your store. The Shopify Changelog lists every Shopify change in full.
Last checked against Shopify's official pages on November 12, 2026.