# Shopify IP allowlist 

Shopify can reject Admin API requests made with your app's access tokens unless they come from a network you have allowed. If a token leaks, it stops working anywhere else. Shopify [requires an allowlist](https://shopify.dev/docs/apps/build/security/credentials-and-data/restrict-api-access-to-your-ip-addresses) for every public app that calls the Admin API. Without one, bulk operations fail from November 12, 2026, and from November 20, 2026, Shopify removes the app from the Shopify App Store and blocks new installs.

## Use an ASN instead of IP addresses 

Gadget calls Shopify from Google Cloud addresses that change over time, so a list of IP addresses would go stale. The [FAQ](https://docs.gadget.dev/guides/faq#if-i-require-ip-whitelisting-is-gadget-able-to-provide-me-with-an-ip-address) has more on where Gadget connects from.

Allow Google Cloud's whole network instead. An autonomous system number, or ASN, identifies one network and every IP range it owns. Google Cloud's ASN is `396982`, which Google's [VPC documentation](https://docs.cloud.google.com/vpc/docs/create-pap#create-roa) lists for the Premium Tier network that Gadget uses. That one entry covers Gadget's syncs, webhook registration, and bulk operations, plus your own `connections.shopify` calls.

Every Google Cloud customer shares this network. The allowlist stops a leaked token used from a home connection or another cloud provider, but not one used from someone else's Google Cloud server in the United States. Keep tokens in your backend code, as described in [protected access tokens](https://docs.gadget.dev/guides/plugins/shopify/advanced-topics/data-security#protected-access-tokens).

## Add Gadget's ASN to your allowlist 

These are Shopify's [setup steps](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist#set-up-an-ip-allowlist) with Gadget's values filled in:

1.  In the [Dev Dashboard](https://dev.shopify.com/dashboard/), open your app, click **Settings**, then click **Manage** in the **IP allowlist** section.
2.  Under **Allow requests from**, select **Networks (ASN)**.
3.  Enter `396982` in the **Autonomous system numbers (ASNs)** field.
4.  Under **Countries**, select **United States**, where Gadget calls Shopify from.
5.  Under **Test against recent traffic**, click **Run test**. It checks the last 30 days of requests and lists any that the allowlist would block.
6.  Turn on **Enforcement**, then click **Save**.

The allowlist holds IP addresses or ASNs, not both, so saving the ASN replaces any IP addresses already there. You do not need Gadget's stable outbound IPs, because `396982` covers them.

Each Shopify app has its own allowlist. If your development environment uses a separate app, repeat these steps for it.

## Requests from outside Gadget 

Shopify checks every request made with your app's tokens, not only the ones from Gadget. For example, a script on your laptop that calls Shopify with a shop's access token fails once enforcement is on.

Move calls like that into Gadget, such as into a global action. Otherwise, add the ASN and country of the network they come from, then run the test again. Use your hosting provider's ASN even if your server has a static IP address, because the allowlist cannot mix the two.

A request passes only when both its ASN and its country are on your lists, as Shopify's [ASN rules](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist#asn-rules) explain. The country list applies to every ASN. For example, adding Germany for your own server also lets in Google Cloud addresses in Germany. Shopify allows up to 10 ASNs and 10 countries.

Some requests follow other rules. Shopify never blocks App Bridge direct API access from your embedded app, and always rejects tokens used in the Shopify Flow **Send HTTP request** action. Shopify's [compatibility notes](https://shopify.dev/docs/apps/build/dev-dashboard/ip-allowlist#compatibility) list the rest.

## Troubleshooting `403` errors 

Once enforcement is on, Shopify answers blocked requests with a `403` status code. In Gadget, they show up in your [logs](https://docs.gadget.dev/guides/development-tools/logger) as failed syncs and failed `connections.shopify` calls. Run the test again to see which requests are blocked. If they come from Gadget, contact Gadget support.