Shopify IP allowlist 

Shopify can reject Admin API requests made with your app's access tokens unless they come from a network you have allowed. If a token leaks, it stops working anywhere else. Shopify requires an allowlist for every public app that calls the Admin API. Without one, bulk operations fail from November 12, 2026, and from November 20, 2026, Shopify removes the app from the Shopify App Store and blocks new installs.

Use an ASN instead of IP addresses 

Gadget calls Shopify from Google Cloud addresses that change over time, so a list of IP addresses would go stale. The FAQ has more on where Gadget connects from.

Allow Google Cloud's whole network instead. An autonomous system number, or ASN, identifies one network and every IP range it owns. Google Cloud's ASN is 396982, which Google's VPC documentation lists for the Premium Tier network that Gadget uses. That one entry covers Gadget's syncs, webhook registration, and bulk operations, plus your own connections.shopify calls.

Every Google Cloud customer shares this network. The allowlist stops a leaked token used from a home connection or another cloud provider, but not one used from someone else's Google Cloud server in the United States. Keep tokens in your backend code, as described in protected access tokens.

Add Gadget's ASN to your allowlist 

These are Shopify's setup steps with Gadget's values filled in:

1. In the Dev Dashboard, open your app, click Settings, then click Manage in the IP allowlist section.
2. Under Allow requests from, select Networks (ASN).
3. Enter 396982 in the Autonomous system numbers (ASNs) field.
4. Under Countries, select United States, where Gadget calls Shopify from.
5. Under Test against recent traffic, click Run test. It checks the last 30 days of requests and lists any that the allowlist would block.
6. Turn on Enforcement, then click Save.

The allowlist holds IP addresses or ASNs, not both, so saving the ASN replaces any IP addresses already there. You do not need Gadget's stable outbound IPs, because 396982 covers them.

Each Shopify app has its own allowlist. If your development environment uses a separate app, repeat these steps for it.

Requests from outside Gadget 

Shopify checks every request made with your app's tokens, not only the ones from Gadget. For example, a script on your laptop that calls Shopify with a shop's access token fails once enforcement is on.

Move calls like that into Gadget, such as into a global action. Otherwise, add the ASN and country of the network they come from, then run the test again. Use your hosting provider's ASN even if your server has a static IP address, because the allowlist cannot mix the two.

A request passes only when both its ASN and its country are on your lists, as Shopify's ASN rules explain. The country list applies to every ASN. For example, adding Germany for your own server also lets in Google Cloud addresses in Germany. Shopify allows up to 10 ASNs and 10 countries.

Some requests follow other rules. Shopify never blocks App Bridge direct API access from your embedded app, and always rejects tokens used in the Shopify Flow Send HTTP request action. Shopify's compatibility notes list the rest.

Troubleshooting 403 errors 

Once enforcement is on, Shopify answers blocked requests with a 403 status code. In Gadget, they show up in your logs as failed syncs and failed connections.shopify calls. Run the test again to see which requests are blocked. If they come from Gadget, contact Gadget support.