BuyerClearShopify app IP allowlist requirement for November 2026
Shopify requires public apps that call its Admin API to enable an IP allowlist by 20 November 2026, with an earlier 12 November deadline for bulk operations. BuyerClear enabled IP allowlist enforcement on 6 November 2026. Shopify’s announcement.
By BuyerClear · Published and reviewed
Product guidance. BuyerClear’s saved enforcement setting was confirmed in Shopify’s Dev Dashboard. The verification scope is explained below.
When is Shopify’s IP allowlist deadline?
The requirement applies to public apps, including apps already installed by merchants. Shopify’s announcement excludes custom apps. Both November deadlines are at 11:59 p.m. US Eastern Time.
| Deadline | Effect without an allowlist |
|---|---|
| Shopify blocks bulk queries and bulk mutations from public apps without an IP allowlist. | |
| Public apps without an IP allowlist are removed from App Store discovery and blocked from new installs. |
These dates and consequences come from Shopify’s 5 November announcement. Existing installations continue after 20 November; Shopify’s setup documentation lists 1 April 2027 for rejection of those apps’ GraphQL and REST Admin API requests.
Has BuyerClear enabled the IP allowlist?
Yes. On 6 November 2026, BuyerClear enabled and saved a network-based IP allowlist for its public Shopify app. After reloading the settings page, Shopify showed Enabled, with enforcement on and a Cloudflare network policy selected.
BuyerClear’s application runs on Cloudflare Workers. Its policy currently has no country restriction. This records the configuration enabled on that date; the recent-traffic test and live-request verification have different limits, described in what was verified.
See our security and data-handling page for this control alongside encrypted application data, staff authorization and document retention.
Do merchants need to add their own IP addresses?
No. This requirement concerns the servers and networks from which an app sends Admin API requests to Shopify. BuyerClear configures its own app policy. Store staff and buyers do not need to submit their home or office IP addresses to BuyerClear for this change.
The allowlist does not decide which buyers qualify for professional purchasing. Credential review, explicit staff approval and Shopify catalog access remain separate parts of the merchant workflow.
How does an ASN allowlist work with Cloudflare Workers?
For hosting with changing outbound IP addresses, Shopify supports a network policy using autonomous system numbers, or ASNs. Shopify can also narrow that policy by country. A provider can operate several networks, so developers should identify the actual sources of their app’s requests. See Shopify’s ASN support announcement.
A domain’s public DNS address is not evidence of the address used for outgoing API calls. Cloudflare documents Workers subrequests as a source of traffic from its network. Developers should compare their actual Shopify API logs with the intended policy before enforcing it, including requests from background jobs.
A provider network is shared with other customers. A stolen token could still be used from an allowed network. Dedicated outbound IPs provide a narrower boundary; a network allowlist does not replace secure token storage and expiry. Shopify explains these limits in its IP allowlist documentation.
What did BuyerClear verify on 6 November?
- Saved configuration: the public app’s settings showed enforcement enabled after a page reload.
- Recent-traffic test: Shopify reported no Admin API requests in the available recent-traffic results. That test could not establish which production requests the policy would allow.
- Live-request acceptance: a fresh Admin API request through the enforced policy and a denied request from another network have not yet been confirmed.
These observations establish the saved control, not a security certification or a guarantee of uninterrupted access. Questions about this update can go to security@buyerclear.com. Keep access tokens and buyer information out of email.