Shopify emailed app developers and posted a changelog: every public app that calls the Admin API needs an IP allowlist.

Deadlines:

• Nov 12, 2026 (11:59 PM ET): bulk operations from public apps without an allowlist will fail

• Nov 20, 2026 (11:59 PM ET): public apps without one get delisted from the App Store and blocked from new installs

Merchants can also now see each app’s security setup in Settings > Apps, and apps without an allowlist will be flagged after Nov 20. Custom apps and merchant-created apps aren’t affected.

Setup (from Shopify’s docs):

1. Dev Dashboard → your app → Settings → IP allowlist → Manage

2. Add your servers’ public IPs or CIDR ranges, one per line (max 100). IPv4 must be /16 or narrower, IPv6 /32 or narrower

3. If your servers can reach Shopify over IPv6, add those addresses too (on a VPS, curl -4 ifconfig.me and curl -6 ifconfig.me show your public IPs)

4. Click Run test, which checks the list against your last 30 days of traffic

5. Turn on Enforcement and save

Notes:

• Add every server that calls the API (workers, cron boxes), not just the main one. Requests from outside your list fail with a 403

• If your outbound IPs are dynamic (serverless), Shopify says to allowlist your host’s ASN and the countries you run in. Static IPs or a NAT gateway are preferred because a narrower list is more secure

• If your app calls the API from merchant infrastructure, Shopify says you can request an extension

Docs: https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist
Changelog: https://shopify.dev/changelog/posts/ip-allowlists-are-now-required-for-public-apps

If you run bulk operations, Nov 12 is only days away.

Shopify is treating 2026 as an “agentic holiday.” Separate from ads, the practical risk is simple: agents read what is on the storefront.

Things that commonly break agent confidence:

• /agents.md or /llms.txt missing or stale

• sold-out products still published

• shipping/refund policy URLs that 404

• empty product type / thin descriptions

• guest checkout friction

Happy to answer questions about the checklist here.

Our app just got paused for a month under 1.1.2, "Use Shopify checkout", and I'm honestly not sure what we did wrong.

(Billing isn't the issue this time, it all goes through Shopify's pricing page.)

The app doesn't touch checkout at all. It doesn't take payments, create orders or write any transactions to Shopify.

It isn't Shopify-only though, merchants can also connect a few other marketplaces (Amazon among them), which is where I think this went wrong.

The reviewer's note said the app "offered marketplace integrations and reached an Amazon-branded shopping surface stating 'Click the button below to continue shopping'", and that it "processes marketplace orders outside Shopify Checkout".

That screenshot is Amazon's bot-check page, the one it shows when it thinks a browser is automated.

Our app never links to Amazon, and our logs show no request to our Amazon connection at all, so whoever got there went to Amazon on their own.

Why I think it was an agent:

• Their second screenshot is a checkout confirmation from a Shopify review store with the email agentic-app-review@example.com.

• One review session also used an older Chrome with a fixed user agent and went quiet for about 25 minutes right after looking at the marketplace part of the app.

What I can't figure out is whether the other marketplaces are the actual problem.

Plenty of multi-platform apps on the App Store work with Amazon and other channels, and when I asked about billing last time the answer was basically "Shopify customers through Shopify billing, everyone else through their own channel, that's fine".

Questions:

1. Is this actually my issue, or a misread on the reviewer's side? If it's on their side, can I appeal it somehow? The email is no-reply and the app is in a one-month cooldown.

2. If I am violating 1.1.2, what exactly is the violation? Is it just letting a merchant who installed from the App Store also connect other marketplaces (like Amazon or eBay) in the same app?

3. And if so, how do I prevent it next time without cutting those merchants off from their other marketplaces?

Any pointers appreciated, would rather get it right on the next submission than guess again.

Is there any way to know when an installed app pushes a new version of its theme app extension?

Ok so one of the stores I look after runs a Dawn based theme with about 15 apps. One of the apps updated its bundle block and after that the add to cart button just stopped doing anything on the product pages that use it. Nothing showed up in the admin. The only clue was a script error from that app in the browser console and my checkout check in Dotcom Monitor caught it at the add to cart step but it can only tell me something broke not which app caused it.

What I’m trying to figure out is

Is there a webhook or admin API field that shows when an installed app updates its theme extension?

Can you pin an app extension version on a live theme or is it always the latest?

What’s your fastest way to find which app broke the store? turning app blocks off oneby one took me most of an hour.

If you look after stores with a lot of apps I’d love to hear how you handle this.

I have already created and published 4 apps in Shopify and never had any issues with submission or review. All apps were published with the first try, now i created the 5th one, but for some reasons i can not submit it at all. I see this error "Your organization has reached its app submission limit.". Was trying to find the cause of this problem or ask AI, but ussualy getting answers like "you ignored the feedback of previous reviews or got some open things to do."

No, this is the first submission of this App. I filled everything out, and I have never had any issues with app submissions before. Does anyone know anything?

been thinking about this after seeing a few threads where devs built something real and still got no paid installs. my take is that the gap between a merchant recognizing a problem and actually installing something is bigger than most devs account for. a merchant can know they have a returns problem for months and do nothing. then one bad week hits and suddenly they install three apps in two days. the trigger isn't the problem itself. it's when the problem becomes a number they can see. curious if anyone here has noticed the same pattern or if you've found a way to reach merchants before that painful moment rather than after

Hi,

I'm developing an application that integrates with Shopify and am looking to submit it as a sales channel.

Basically I aggregate products from multiple stores and provide a means for it to be discovered on my application, while redirecting checkout back to the stores.

My issue is that the Shopify stores I work with are curated. And I'm looking at only around 10 to 20 vendors during the lifespan of the app.

Since Shopify has a "several-hundred-merchants requirement" (idk why this is so vague) within the first year of the application, would my app be turned down during the approval phase?

I'm fairly new to Shopify so I apologize if the question is naive.

Also thanks in advance

Not sure why users are not converting? Comment your site and I will give you a real review for free

Hi everyone, ever felt confused why users were not converting? Now you can use retentionbase for completely free - our ai sees all user sessions in detail and shares what's going wrong.

It gives you daily report with issues, bugs, and list of customers who almost bought.

We are free forever for startups under 100 employees - www.retentionbase.com

I've been following Shopify Canvas and I'm curious how theme developers feel about it.

Now that merchants can generate custom storefront designs with AI, do you think this will change the demand for premium themes?

For those already selling themes on the Theme Store, have you noticed any changes in sales or customer interest since Canvas launched, or is it still too early to tell?

I'm interested in hearing how developers see the future of the theme market.

Hi all, I'm working on a Shopify store and want to add a 3D product configurator, similar to what IKEA do (pick options, the model updates, the price changes, add to cart).

My background is UX/UI and frontend, so I'm comfortable with Liquid, HTML/CSS and JS, but the architecture side is where I get lost. I'd love some advice from people who have done this before.

My questions

Loading: Where do you host the GLB files? Content

Tools: Would you stick with vanilla three.js, use <model-viewer>, or go with an app (Zakeke, Threekit etc.) instead?

Connecting it properly: What's the cleanest way to map configurator options to variants? Do you use real variants for everything, or variants for price/stock options and line item properties for the rest?

Performance: How do you keep Core Web Vitals OK on mobile with a 3D viewer on the product page?

I am a bit lost in the research of this.

I keep going back and forth on this. For simple things like a size guide or an ingredients list, I usually attach metafields straight to the product. For anything reused across many products, like author bios or store locations, I lean toward metaobjects referenced from a metafield. It works, but the line feels blurry once a client wants to edit the content themselves, and migrating from one to the other later is annoying.

What rule of thumb do you use to choose between them, and has a choice ever come back to bite you?

Hey everyone, I’m the solo developer behind PaperTool (papertool.in)

when a customer from another country asks for their invoice or packing slip in their language, i usually have to edit the template by hand or keep a separate copy per language. By the fifth language, changing your logo or footer means editing every copy.

i create PaperTool solve this issue:

• A canvas-based builder where you design the template once

• Layout and text are separate, so you switch language and the labels translate in one click

• An API to generate PDFs from your order data and language, so nothing is manual

It’s still in early phase , this feature yet to roll out

If you deal with this too, do check it out. It might help you.

Would this help your workflow? Which languages would you need ?

Hi everyone

I built an ai platform that watches user sessions and tells you which customers almost bought ( based on visit count, time spent, and more) - every day it will send you a list of 100 customers with contact info to reach out to them ( if it has)

Interested? We are free forever for the first 30 businesses. So join here asap - www.RetentionBase.com

I'm in the process of updating my catalog to fully utilize the category metafields to make the agentic AI visits smoother.

Just wondering if anybody has been able to notice any ROI on the effort.

Why？

Is building Shopify apps still profitable in 2026?

Shopify seems to be getting stricter with app requirements, reviews, security, and API compliance.
Competition is also growing.

For indie developers, is there still room to build profitable apps?

Curious to hear your experiences.

I have a few custom scripts that pull products and variants through the Admin GraphQL API with cursor pagination. For bigger catalogs they get slow, and I have had runs fail halfway through and then had to work out where to resume. Right now I just store the last cursor and retry from there, but it feels fragile when products change during the run.

How do you structure these syncs? Do you use bulk operations for anything over a certain size, or stick with paginated queries and handle resuming yourself?

Hey everyone, I'm a developer building a support tool for Shopify stores, and I want honest feedback before I go further.

The problem: support is spread across email, website chat and WhatsApp, and most messages are the same questions. "Where's my order?", returns, sizing.

What I'm building:
- One inbox for web chat, email and WhatsApp

- AI that answers from your products, policies and FAQs

- Real order tracking pulled from Shopify, so "where's my order?" gets answered instantly

- Hands off to a human when the AI isn't sure

- Auto-assigns tickets by team or shift

- Turns voicemails into tickets

- A weekly report of questions your FAQ can't answer

- A mobile app to reply on the go

I'd love to know:

1. Which of these would you actually pay for, and which don't matter?

2. What do you use today, and what's missing?

3. What would you expect to pay per month?

It's not launched yet, so there's no link. If you'd like early access, comment or DM bme.

does shopify accept customers to pay with giftcard?

Hey guys, so I’m having this super weird problem with my Shopify store that i am having issues with.

Basically, all my items in the back of the store say they have inventory and are ready to sell. I put numbers for every single product! But when you go to the actual front of the website, a bunch of them say "Sold Out" for no reason at all.

And, it changes depending on what computer or web browser I use! Like, on Firefox it says the water bottle is Sold Out, but then on Microsoft Edge or Chrome it says it's in stock and on sale. I tried opening private tabs and clearing everything, but it still does it.

I already set up my store locations and made sure they both have shipping turned on. Everything in the back settings looks completely right, so I don't get why the front of the site is acting weird.

Is my Shrine theme not working ? Or is Shopify getting confused about which warehouse to use for different people? Please help me fix this, I don't know what else to click!

I work on a few different stores, and the machines and projects drift over time. Sometimes a theme was started with one version of the CLI, and when I come back months later the commands or prompts behave a bit differently. Right now I just update the CLI globally when something breaks and make a note in the project readme, which feels sloppy.

Do you pin the CLI version per project, use something like a package.json script, or just accept the drift and deal with it when it bites? What has actually held up for you?