Shopify IP allowlist: 5 checks before 20 November From 20 Nov, every public Shopify app needs an IP allowlist. If your app uses bulk operations, the date has already passed (12 Nov). I ran my own apps through it this week. The checks: 1) Do you use bulk operations? That sets your deadline. 2) Do Admin API calls come from a fixed server or a serverless host? (Serverless: use the new ASN allowlist.) 3) Is the allowlist in shopify.app.toml, and deployed? 4) Which workers, cron jobs and queues call the Admin API outside the web server? 5) Who gets told when a call is refused? Number 4 is the one that bites. The 3 a.m. background job fails quietly. Which host are your apps on, IP or ASN?